Incident Response Python Packages

volatility3

Volatility 3.0 development

cortexutils

Cortex Analyzers Repository

horus-source

Graph-powered code intelligence engine — indexes codebases into a knowledge graph, exposed via MCP tools for AI agents and a CLI for developers.

cirdanops

AI infrastructure cartographer and operations daemon — Graphify for live infrastructure. Fingerprints, graphs, and watches Docker/Kubernetes/AWS/IaC for AI agents via CLI + MCP.

tenzir

Tenzir is the data pipeline engine for security teams.

firefighter-incident

FireFighter is an incident management application, designed to work in Slack, and more.

cortex4py

Python API Client for Cortex

ecs-doctor

One command to diagnose why your ECS service is failing — events, logs, ALB health, metrics, config, and network in a single confidence-scored report

intelmq

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

autosentry

Self-healing supervisor for long-running processes — watch a command, catch the failure, fix it, leave a paper trail.

gitgalaxy

An AST-free, LLM-free heuristic knowledge graph engine for deep repository intelligence. Map, secure, and modernize enterprise codebases across 50+ languages at extreme velocity

projectair

Project AIR: forensic reconstruction and incident response for AI agents. Signed AgDR decision records, OWASP ASI01-ASI10 detection, signed forensic evidence exports.

apiosintds

On demand query API for https://github.com/davidonzo/Threat-Intel project.

pyvast

Tenzir is the data pipeline engine for security teams.

ops-copilot

Self-hosted SRE investigation copilot with LangGraph, YAML-defined SSH tools, SSE streaming, sanitization, and built-in secret redaction.

spero

Self-healing supervision agent for Linux hosts and Kubernetes

phishsage

CLI toolkit for email phishing analysis. Parses .eml files, runs heuristic checks on headers, links, and attachments, and outputs structured JSON.

bedrock-keys-security

Detect phantom IAM users, decode leaked AWS Bedrock and Claude Platform API keys, and prevent LLMjacking. CLI + SCPs + SIEM detection rules.

django-incident-response

Monzo's real-time incident response and reporting tool ⚡️

resq-mcp

FastMCP server exposing ResQ platform capabilities to AI clients

chickadee

Yet another GeoIP resolution tool.

lerc-control

Libraries and utilities for controling and working with Live Endpoint Response Clients.

ransomwatch

ransomwatch is a Python based tool designed for ransomware threat intelligence and security research.

pyrsistencesniper

We took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSniper.