Blueteam Python Packages

theharvester

E-mails, subdomains and names Harvester - OSINT

yaralyzer

Visually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.

defaultcreds-cheat-sheet

One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️

pyloobins

Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" macOS binaries and how they can be used by threat actors for malicious purposes.

vulnparse-pin

A Vulnerability Intelligence and Decision Support Engine — Making Vulnerability Triage Faster and Remediation Decisions Explainable

slack-watchman

Slack enumeration and exposed secrets detection tool

plumhound

Bloodhound Reporting for Blue and Purple Teams

ransomwatch

ransomwatch is a Python based tool designed for ransomware threat intelligence and security research.

fibratus

Adversary tradecraft detection, protection, and hunting

certpatrol-orchestrator

Process orchestration platform for managing multiple CertPatrol instances with a modern web interface.

gitlab-watchman

Finding exposed secrets and personal data in GitLab

goodhound

Uses Sharphound, Bloodhound and Neo4j to produce an actionable list of attack paths for targeted remediation.

asp-cli

Agentic SOC Platform: A powerful, flexible, open-source, and agent-centric automated security operations platform (AI SOC)

certpatrol

A fast, lightweight Certificate Transparency (CT) log tailer for your terminal. Filter domains with regex, run locally for privacy, and monitor in real time — no third-party servers, no tracking. A modern, local, privacy-friendly CertStream alternative.

favicorn-osint

All-sources tool to search websites by favicons

crack-o-matic

Find and notify users in your Active Directory with weak passwords

gtfobins-cli

Command-line tool for GTFOBins - Unix binaries exploitation helper

github-watchman

Monitoring GitHub for sensitive data shared publicly

slack-watchman-eg

Monitoring Slack Enterprise Grid for exposed secrets

honeycheck

Honeycheck detects rogue dhcp servers and provides a modular and fully configurable action environment in case they are found

stack-overflow-watchman

Detecting exposed secrets in Stack Overflow Enterprise for Teams

urlbreakdown

splits a URL into individual components, unescapes arguments, and performs light calculations for manual or automated analysis

skipper-cli

A free, open-source SOC automation and recon toolkit

trello-watchman

Monitoring your Trello boards for sensitive information