Blue Team Python Packages

adversarial-robustness-toolbox

Adversarial Robustness Toolbox (ART) - Python Library for Machine Learning Security - Evasion, Poisoning, Extraction, Inference - Red and Blue Teams

kcwarden

Automatically audit your Keycloak configuration for security issues

aptl-labs

Single-user OpenRÆ backend for creating sandboxes, cyber ranges, digital twins, and other environments.

mcp-server-malcolm

Ask an AI agent about your Malcolm network traffic. MCP server for Zeek, Suricata, Arkime and NetBox data, read-only until you opt in to writes.

otacon

Domain impersonation detector — typosquatting, homoglyph & combosquat detection. One command, ~10s, no paid APIs.

vamp-log-analyzer

Plataforma forense de análisis de logs multiplataforma — 25 detectores FORA, timeline, reconstrucción de sesiones, cadena de custodia, IOC export, mapeo MITRE ATT&CK — VampSecure Labs

honeypot-auditor

Does This Look Like An Honeypot? (DTLLAH) Multi-protocol CLI that fingerprints whether a target IP behaves like an honeypot — using Honeyscore, active auth/state probes, and a weighted score.

vamp-log-hunter

VampSecure Labs — Cazador de IoC en logs del sistema (nginx/auth/syslog)

rule-doctor-lite

Free read-only check: which custom Wazuh rules never fire, and why (including rules Wazuh drops at load). Python 3, one file.

fibratus

Security sensor for realtime threat detection and protection

slack-watchman

Slack enumeration and exposed secrets detection tool

pcaptriage

Automated pcap triage on top of Zeek: MITRE ATT&CK-mapped findings and an HTML report, in one command.

sshd-lint

Zero-dependency, offline static analyzer for OpenSSH sshd_config. Flags weak crypto, auth, and access-control settings for SSH hardening, referencing CIS, Mozilla, and NIST guidance, with CI-friendly exit codes.

sigwood

Local-first threat hunting for the logs you already have: Zeek, Pi-hole, syslog or the systemd journal, CloudTrail. Every run names the technique behind each detector. No agent, no daemon, no black box - between grep and a SIEM.

vamp-arp-sentinel

VampSecure Labs: ARP spoofing detector + PoC lab (Scapy + Rich)

aisoc-sandbox

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

vamp-entropy-watch

VampSecure Labs: Ransomware detector via Shannon entropy (Rich Live)

opensquat

openSquat is an open-source tool that detects look-alike domains impersonating your brand, by scanning newly registered domains daily.

vigil-redteam

A Cyber Security Reseach tool created to help ship better and complete products.

zimkk-vigil

A Cyber Security Reseach tool created to help ship better and complete products.

evtxtoelk

Load Windows Event Log (.evtx) files into Elasticsearch, or export them as JSON lines. Born on an offline threat hunt; rebuilt for Elasticsearch 9.

phishsage

CLI toolkit for email phishing analysis. Parses .eml files, runs heuristic checks on headers, links, and attachments, and outputs structured JSON.

cepheus-engine

Container escape scenario modeler — enumerate container security posture and model realistic escape paths

tracesig

Sigma-style detection rules for AI agent tool-call traces: 23 provenance, taint and sequence rules. Scans Claude Code sessions and agent-policy-gateway audit logs; works on any agent's JSONL trace.