Detection Engineering Python Packages

detect-droid

A pySigma wrapper to manage detection rules.

txt2detection

A command line tool that takes a txt file containing threat intelligence and turns it into a detection rule.

agentic-threat-hunting-framework

ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.

1200km-aidebug

AI-assisted malware reverse-engineering debugger with ATT&CK, YARA, IOC, and report output.

sigmalint-cli

ESLint-style linter for Sigma detection rules. Validates against Sigma 2.1.0, scores rules across six quality dimensions, emits stable rule IDs.

iocx

An extensible, deterministic static‑analysis engine that extracts high‑signal IOCs from PE binaries and text, built for SOC automation and modern threat‑analysis pipelines.

ocsfkit

OCSF workbench CLI for normalizing, linting, explaining, diffing, and querying security events

splint-spl

A fast, zero-dependency linter for Splunk SPL — catch slow searches before they hit production.

hushspec

Portable specification for AI agent security rules

esxi-testing-toolkit

No description available