davehull/Kansa

Health v2 · maintenance only

Adoption not part of the score

1661 stars · 275 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Kansa is a modular incident response framework written in PowerShell that uses PowerShell Remoting to run data-collection modules across many hosts in an enterprise. It gathers forensic data for incident response, breach hunts, and environmental baselining, with analysis scripts for large-scale collections.

Use cases

• collect forensic data from thousands of windows hosts during incident response
• hunt for breaches across an enterprise network
• build an environmental baseline of system state
• run remote powershell modules at scale via winrm
• analyze collected endpoint data for signs of compromise

When to choose

• you need rapid, remote data collection across many Windows systems during a security incident
• your environment already uses PowerShell Remoting and you want a free, scriptable DFIR collector
• you want modular, extensible collection scripts you can run standalone or at scale

When to avoid

• you need a cross-platform or Linux/macOS incident response tool
• you want a GUI-driven or actively maintained commercial-grade DFIR product
• your environment restricts PowerShell Remoting or execution of unsigned scripts

Facets

framework · maturity maintenance

security developer-tools cli security developer-tools windows windows cli incident-response powershell-remoting forensics threat-hunting dfir enterprise-data-collection

Member repositories

For agents

markdown · JSON · MCP: product_card(name="davehull/Kansa")