Incident Response Python Packages

volatility3

Volatility 3.0 development

cortexutils

Cortex Analyzers Repository

tares

The open-source platform for always-on AI agents. Connect anything that emits events; Tares puts every event on one timeline per thing, wakes an agent the moment it matters, and keeps the answer for the next reader. Works with Claude Code, Cursor and your own agents over MCP.

tenzir

Tenzir is the data pipeline engine for security teams.

argus-obs-semconv

Production-grade observability and agentic AIOps for AI systems — OpenTelemetry-native across independent polyglot apps; GenAI semantic conventions with token/cost attribution; sub-2s detection on a hot path that skips the datastore; LLM agents that find root cause and notify. ClickHouse + Langfuse. 100% self-hosted — no vendor lock-in.

argus-obs-sdk

Production-grade observability and agentic AIOps for AI systems — OpenTelemetry-native across independent polyglot apps; GenAI semantic conventions with token/cost attribution; sub-2s detection on a hot path that skips the datastore; LLM agents that find root cause and notify. ClickHouse + Langfuse. 100% self-hosted — no vendor lock-in.

argus-obs-schemas

Production-grade observability and agentic AIOps for AI systems — OpenTelemetry-native across independent polyglot apps; GenAI semantic conventions with token/cost attribution; sub-2s detection on a hot path that skips the datastore; LLM agents that find root cause and notify. ClickHouse + Langfuse. 100% self-hosted — no vendor lock-in.

gitgalaxy

Convert source code into a repository-scale structural model. Air gapped, zero dependencies, SARIF and SBOM outputs.

google-secops-mcp

Google SecOps MCP server

firefighter-incident

FireFighter is an incident management application, designed to work in Slack, and more.

pyvast

Tenzir is the data pipeline engine for security teams.

gti-mcp

Google Threat Intelligence MCP server

intelmq

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

ventra

Cloud forensic triage for AWS, Azure, GCP and Kubernetes

netforensicai

Local-first, open-source DFIR investigation platform. Correlates pcap, JSON/CSV and Windows EVTX/Sysmon evidence into one traceable timeline, entity graph and evidence-cited findings - with offline detection rules, MITRE ATT&CK mapping, a local web UI, live capture, and an optional AI assistant that cannot fabricate citations.

talus-process-monitor

eBPF ransomware detection & response agent for Linux — single static binary, no kernel modules, behavioural scoring, process pause/kill

mulder-dfir

Agentic DFIR

autosentry

Self-healing supervisor for long-running processes — watch a command, catch the failure, fix it, leave a paper trail.

devops-agent-harness

Model-agnostic DevOps AI agent harness: policy, approvals, audit and rollback enforced outside the LLM. Works with Claude Code, OpenCode, Cursor, Copilot and any MCP client.

kubeintellect

An AI SRE for Kubernetes: connects to your cluster, investigates with real tools, explains the root cause in plain English, and executes the fix only after you approve it. Peer-reviewed — Journal of Grid Computing, 2026.

gokdogan-triage

Static PE malware triage engine — imphash/entropy/packer/strings/capabilities/YARA + MITRE ATT&CK, weighted verdict. No sample execution, offline core.

pagerduty-oncall-ack

Local CLI that acknowledges PagerDuty incidents only when the configured user is on call.

cortex4py

Python API Client for Cortex

agent-gorgon

Runtime policy guard for AI agent processes: watches process, file, and network activity from user space, applies deterministic policy, and attempts SIGSTOP or SIGKILL on reviewed triggers — no SDK required, works against any PID. Audit-only mode rehearses policy first; every decision logged as evidence.