Detection Engineering Python Packages

wazuhcoverage

A small batch CLI for measuring coverage in Wazuh JSON archives.

agentic-threat-hunting-framework

ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.

detect-droid

A pySigma wrapper to manage detection rules.

wazuhtester

wazuhtester is a Python library and command-line tool for interacting with the Wazuh wazuh-logtest daemon.

pysigma-backend-varpulis

pySigma backend for Varpulis VPL: Sigma rules, correlation rules included, as detection streams

1200km-aidebug

Evidence-focused malware reverse engineering with deep PE/.NET inspection, Ghidra reconstruction, AI cross-checks, YARA, and ELF debugging

rule-doctor-lite

Free read-only check: which custom Wazuh rules never fire, and why (including rules Wazuh drops at load). Python 3, one file.

fibratus

Security sensor for realtime threat detection and protection

wazuhevtx

A Python tool that parses EVTX files and converts them into JSON formatted logs mimicking Wazuh agent behavior in version 4.x. wazuhevtx is designed as a helper for wazuh-logtest tool.

iocx

An extensible, deterministic static‑analysis engine that extracts high‑signal IOCs from PE binaries and text, built for SOC automation and modern threat‑analysis pipelines.

rulevis

RuleVis is a powerful analysis tool that transforms your Wazuh ruleset into a dynamic, interactive force-directed graph. It helps you visualize the complex relationships between rules, identify critical dependencies, discover structural issues, and analyze the distribution of your rule IDs.

txt2detection

A command line tool that takes a txt file containing threat intelligence and turns it into a detection rule.

wazuhscatune

A helper for Wazuh Security Configuration Assessment (SCA) to create a custom SCA based on loosening.

wresult

wresult provides the running configuration of a Wazuh agent by reconstructing how it applies ossec.conf and agent.conf.

aisoc-sandbox

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

wazuhtestgen

A tool to help detection engineers generate Wazuh rule tests either derived from INI test files from Wazuh repository, Windows Event Log (EVTX) files, or Wazuh rule files. The test format uses Python's unittest. It is designed to accompany wazuh-devenv project.

wazuhregex

wazuhregex is a Python package and command-line tool that implements Wazuh regex behavior for local testing and development. It lets you validate one pattern against all three Wazuh regex engines in one run.

hushspec

Portable security rules for the action boundary of AI agents

redgap

Automated MITRE ATT&CK offense-detection coverage harness - deterministic, no AI in the verdict.

tracesig

Sigma-style detection rules for AI agent tool-call traces: 23 provenance, taint and sequence rules. Scans Claude Code sessions and agent-policy-gateway audit logs; works on any agent's JSONL trace.

iflow-mcp-m507-ai-soc-agent

Blackhat 2025 presentation and codebase: AI SOC agent & MCP server for automated security investigation, alert triage, and incident response. Integrates with ELK, IRIS, and other platforms.

aisoc-detections

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

gsh-framework

Open-source hunt playbooks and a policy-driven Sentinel reference framework for detecting runaway AI agents, unauthorized tool calls, behavioral drift, DNS exfiltration, and poisoned MCP tools. MITRE ATLAS mapped.

aisoc-sdk

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.