The Coroner's Toolkit (TCT) provides post-break-in data collection that could be useful in determining what happened. Less polished that the authors (Dan Farmer and Wietse Venema) usual work, the toolkit offers a patch-work of tools that help exhume interesting stuff from violated systems. Should be installed and examined before a break-in happens!
lsof is a tool for examining I/O channels open on your Unix system. These can include files, FIFOs and network sockets. This information can be extremely useful for security and a variety of other purposes. Works on most Unix-like systems.
The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols with full-strength cryptography world-wide.