PAGES
← all tools
◆ Digital Forensics & Incident Response

GRR

v.4.0.0.0-release open-source

4 more tools, grouped by what they do.

Digital Forensics & Incident Response

Container & Image Security

SIEM

Incident response framework with a Python agent installed on target systems and server infrastructure for remote live forensics.

source ↗ website ↗ rss ↗ What is a cyber toolchain?

Summary

GRR is an open-source incident response framework, free to use, built for remote live forensics on endpoint systems. It runs as a python agent installed on target machines paired with python server infrastructure that manages and communicates with those clients, so adoption means standing up and operating that server yourself rather than installing a local tool. It's aimed at incident responders and forensic analysts who need to inspect and collect evidence from fleets of remote machines rather than a single workstation. It sits in the DFIRDFIRDigital forensics and incident response, investigating what happened during a security incident and containing it. The work includes preserving evidence, reconstructing activity and restoring systems. space, alongside other remote-forensics and endpoint-investigation frameworks, though its own documentation doesn't name specific peers. Started in 2011 and still active, with 68 contributors and 32 commits in the past year, though its most recent release was 249 days ago.

Incident response framework with a Python agent installed on target systems and server infrastructure for remote live forensics.

How GRR helps

Which of my machines are compromised right now, and what's running on them?

queries the agent on each endpoint live and returns processes, network connections and open files as they stand at the moment of collection, not from a snapshot taken earlier

Which hosts across my fleet have a given malicious file or registry key on disk?

dispatches the same search across all selected endpoints in parallel and reports back per-host hits, so a fleet-wide sweep replaces logging into machines one at a time

What changed on this endpoint between two points in time?

pulls filesystem and process state directly from the agent on demand, so an analyst can compare collections taken at different moments instead of trusting a single static image

Who was logged into this machine, and what did they run?

collects the live artifacts on the endpoint through the same agent-server pipeline used for other sweeps, returning results centrally rather than requiring shell access to the box

Where else in my organization has this same indicator shown up?

runs one collection request against the whole managed fleet rather than a single workstation, returning matches host by host from the server that manages all the agents

all 6 features, with the evidence for each →

Languages

Not documented

Features

6 capabilities · 1 backed by code, an API document or a real run

Built from GRR's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What GRR offers you

  • Command-line interface1
All capabilities 6 capabilities
Hunt creation and management workflow shipped suggested Creates hunts from flows, duplicates existing hunts, monitors hunt progress, and inspects results. 6 releases · first seen Apr 2015

Suggested capability: Remote forensic collection. This is our guess, not confirmed.

release

  • Hunts workflow is now available in the new UI: creating hunts from a flow, duplicating existing hunts, monitoring hunt progress and inspecting results v3.4.7.1-release · Oct 2023 · source · release history
  • Changes default landing page to Recent activity view and allows basic machine info access without approval. v3.1.0.2 · Jun 2016 · source · release history
  • Adds ability to create a new hunt from an existing flow for fleet-wide testing. v3.1.0.2 · Jun 2016 · source · release history
  • Adds OR conditionals to the Hunt UI search filters for precise target scoping. v3.1.0.2 · Jun 2016 · source · release history
  • Adds an HTTP API in the UI to directly query GRR data v0.3.0-6 · Apr 2015 · source · release history
  • Adds HTTPDataStore as a highly scalable datastore option to support large GRR instances up to thousands of clients v0.3.0-6 · Apr 2015 · source · release history
Command signature generation verified Generates signatures for commands supplied via a textproto input file, with an option to prune existing signatures from the database before writing new ones. 2 releases · 3 other sources · first seen Oct 2023

Also counts toward: Command-line interface

release

  • Distributes GRR via Docker image and Docker Compose configuration as the primary deployment method v3.4.7.4-release · May 2024 · source · release history
  • Podman-based zero-setup development environment v3.4.7.1-release · Oct 2023 · source · release history

command line

  • --input_file — Input textproto file with commands to generate signatures for. v3.4.9.0-release · Feb 2025 · command-line history
  • generate_command_signatures_from_file — Generate signatures for all given commands. v3.4.9.0-release · Feb 2025 · command-line history
  • --regenerate — If true prunes the database of existing signatures before writing. v3.4.9.0-release · Feb 2025 · command-line history
GCS output plugin shipped suggested Outputs collected artifacts to Google Cloud Storage. 1 release · first seen Apr 2025

Suggested capability: Remote forensic collection. This is our guess, not confirmed.

release

  • Adds a GCS output plugin capability to the GRR server v3.4.9.1-release · Apr 2025 · source · release history
Multi-file system information collection shipped suggested Collects statistics or hashes for multiple files in a single operation via dedicated flows. 1 release · first seen Oct 2023

Suggested capability: File integrity monitoring. This is our guess, not confirmed.

release

  • Added StatMultipleFiles and HashMultipleFiles flows to be used in UIv2 v3.4.7.1-release · Oct 2023 · source · release history
Bigquery output plugin shipped Exports flow results to Google BigQuery. 1 release · first seen Jun 2016

release

  • Adds Bigquery output plugin for exporting flow results to BigQuery. v3.1.0.2 · Jun 2016 · source · release history
HTTP API support shipped Allows execution of any UI-available action via HTTP API to enable automated workflows. 1 release · first seen Jun 2016

release

  • Adds HTTP API support to execute any action available in the UI, enabling automated collection and export workflows. v3.1.0.2 · Jun 2016 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for GRR, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail GRR puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Website history

adk.dev, every change

Google's 40 pages as they looked each month from August 2026 to October 2026: 79 renders, 1 change of tagline or palette. Step through them, play them, or put any two months side by side.

Website history is included with Researcher and Business.

See plans →

Releases

Show

8 entries

  1. December 20251
  3. April 20251
  5. February 20251
  7. June 20241
  9. May 20241
  11. October 20231
  13. June 20161
  15. April 20151
    Show

    8 entries

    1. v.4.0.0.0-release Dec 15, 2025 · release notes

      GRR v4 adds RRG (Rust) agent support, APIv2 migration, new ListFlowOutputPluginLogs endpoint and flow debugging UI

      └──▷ GET THIS VERSION 
      $ git clone --branch v.4.0.0.0-release https://github.com/google/grr.git
# already have the repo? check out this version:
$ git checkout v.4.0.0.0-release
      └──▷ TRY IT
      Fetch client flows including progress data in APIv2.
      $ curl -X GET https://<grr-server>/api/v2/clients/<client_id>/flows?top_flows_only=false \ -H 'Authorization: Bearer <token>'
      • Adds a new ApiListAllFlowOutputPluginLogs endpoint for retrieving output plugin logs across all flows.
      • Enables server-side support for the Rust-based RRG agent alongside the legacy Python agent for action scheduling.
      • Introduces include_metadata argument to the ListGRRBinaries API method, returning binary size, signature validity and timestamp when true.
      • Extends /api/clients/<client_id>/flows with progress data via the top_flows_only=false parameter on the ListFlows method.
      • Changes the Interrogate flow return type from ClientSummary to ClientSnapshot, providing a superset of client information.
      +1 more show less
      • Adds dark mode, nested flow display, and debugging logs for flows and fleet collections in the new UI layout.

      6 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !Legacy HTTP API v1 (/api/...) is removed; all calls must now use the protocol-buffer-based APIv2 (/api/v2/...).
      • !The GetFile flow is no longer available.
      • !Variable hunts are no longer supported in Fleet collections.
      • !Custom OutputPlugin implementations must be replaced with OutputPluginProto implementations due to stateless protocol-buffer migration.
    2. v3.4.9.1-release Apr 16, 2025 · release notes

      Adds a Google Cloud Storage (GCS) output plugin for exporting artifacts from the GRR server.

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.4.9.1-release https://github.com/google/grr.git
# already have the repo? check out this version:
$ git checkout v3.4.9.1-release
    3. v3.4.9.0-release Feb 27, 2025 · release notes

      GRR v3.4.9 adds %SystemDrive%\Users collection support; renames restricted_flow_users/groups to admin_users/admin_groups.

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.4.9.0-release https://github.com/google/grr.git
# already have the repo? check out this version:
$ git checkout v3.4.9.0-release
      • Adds listing of %SystemDrive%\Users as a supplementary mechanism for collecting Windows user profiles alongside registry data.
      • Renamed restricted_flow_users and restricted_flow_groups to admin_users and admin_groups respectively.

      2 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !The APIv1 is removed; you must use the v2 API (URLs containing /v2/).
      • !The legacy AngularJS UI (UIv1) is removed.
      • !ListFlowApplicableParsers API method removed.
      • !ListParsedFlowResults API method removed.
      • !ApiClient.users field removed; use ApiClient.knowledge_base.users instead.
      • !GREP artifact source support removed.
      • !Configuration options Server.fleetspeak_enabled, Client.fleetspeak_enabled, Client.server_urls, Client.control_urls, Client.server_serial_number, Client.poll_min, Client.poll_max, Client.error_poll_min, Client.labels, Client.rss_max, Client.rss_max_hard, Frontend.bind_port, Frontend.port_max, Nanny.child_binary, Nanny.child_command_line, Nanny.service_name, Nanny.service_description, Nanny.statusfile, Nanny.binary, Nanny.service_binary_name removed.
      • !restricted_flow_users and restricted_flow_groups configuration keys renamed to admin_users and admin_groups.
    4. v3.4.7.5-release Jun 27, 2024 · release notes

      GRR v3.4.7.5 adds grr_api_client standalone usage and Windows %SystemDrive%\Users fallback.

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.4.7.5-release https://github.com/google/grr.git
# already have the repo? check out this version:
$ git checkout v3.4.7.5-release
      • grr-api-client package no longer has an implicit dependency on grr-response-core, allowing standalone installation
      • Adds listing %SystemDrive%\Users as a supplementary mechanism for collecting user profiles on Windows

      2 details in Everything

    5. v3.4.7.4-release May 28, 2024 · release notes

      GRR v3.4.7.4 adds Docker distribution, CrowdStrike file decoding in Python API, and removes several legacy APIs.

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.4.7.4-release https://github.com/google/grr.git
# already have the repo? check out this version:
$ git checkout v3.4.7.4-release
      • Distributes GRR via Docker image and Docker Compose configuration as the primary deployment method
      • Adds DecodeCrowdStrikeQuarantineEncoding function to the Python API for decoding CrowdStrike quarantine files from a BinaryChunkIterator
      • Improves YARA memory scanning with better matching context options and reduced bandwidth consumption

      3 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !The provides field is removed from the Artifact message
      • !Support for Chipsec based flows is removed
      • !ClientArtifactCollector flow and related client actions are removed
      • !Indexing endpoints on snapshot uname are removed; search must use individual system name, release and version fields
      • !Support for foreman rules using uname of an endpoint is removed; must simulate with 3 rules for system name, release and version
      • !Artifact parsers subsystem is removed; ArtifactCollector now works as if apply_parsers is False
      • !GetClientLoadStats API method (/api/clients/<client_id>/load-stats/<metric>) is removed
      • !ApiReportData definition changed: support for stack, line and pie charts removed, along with all related report plugins
      • !GetFileDecoders API method (/api/clients/<client_id>/vfs-decoders/<path:file_path>) is removed
      • !GetDecodedFileBlob API method (/api/clients/<client_id>/vfs-decoded-blob/) is removed
    6. v3.4.7.1-release Oct 25, 2023 · release notes

      New Hunt workflow in UIv2 and Podman dev environment; renamed default_output_plugins config key

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.4.7.1-release https://github.com/google/grr.git
# already have the repo? check out this version:
$ git checkout v3.4.7.1-release
      • Hunts workflow is now available in the new UI: creating hunts from a flow, duplicating existing hunts, monitoring hunt progress and inspecting results
      • Added StatMultipleFiles and HashMultipleFiles flows to be used in UIv2
      • Podman-based zero-setup development environment
      • Renamed AdminUI.new_hunt_wizard.default_output_plugin to AdminUI.new_hunt_wizard.default_output_plugins (note the s in the end). The new option accepts a comma-separated list of names

      4 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !AdminUI.new_hunt_wizard.default_output_plugin is renamed to AdminUI.new_hunt_wizard.default_output_plugins; the previous singular key no longer works
      • !The deprecated use_tsk flag has been fully removed
    7. v3.1.0.2 Jun 17, 2016 · release notes

      GRR v3.1 introduces HTTP API for all UI actions, hunt OR conditionals, and BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. output plugin

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.1.0.2 https://github.com/google/grr.git
# already have the repo? check out this version:
$ git checkout v3.1.0.2
      • Adds HTTP API support to execute any action available in the UI, enabling automated collection and export workflows.
      • Adds OR conditionals to the Hunt UI search filters for precise target scoping.
      • Adds Bigquery output plugin for exporting flow results to BigQuery.
      • Adds ability to create a new hunt from an existing flow for fleet-wide testing.
      • Changes default landing page to Recent activity view and allows basic machine info access without approval.

      5 details in Everything

    8. v0.3.0-6 Apr 17, 2015 · release notes

      GRR v0.3.0-6 introduces new HTTP DataStore backend and UI-based HTTP API for data queries

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.3.0-6 https://github.com/google/grr.git
# already have the repo? check out this version:
$ git checkout v0.3.0-6
      • Adds HTTPDataStore as a highly scalable datastore option to support large GRR instances up to thousands of clients
      • Adds an HTTP API in the UI to directly query GRR data

      2 details in Everything

    Project health

    Issue, contributor and maintainer activity in google/grr, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 3 −1 vs prior 12 months
    2. Maintainers 1 +1 joined · −3 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 17 days first maintainer reply 17 days
    6. Open backlog 141 of 686 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 141
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 5,089
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback