Purple Team Python Packages

aptl-labs

Single-user OpenRÆ backend for creating sandboxes, cyber ranges, digital twins, and other environments.

honeypot-auditor

Does This Look Like An Honeypot? (DTLLAH) Multi-protocol CLI that fingerprints whether a target IP behaves like an honeypot — using Honeyscore, active auth/state probes, and a weighted score.

fibratus

Security sensor for realtime threat detection and protection

slack-watchman

Slack enumeration and exposed secrets detection tool

aisoc-sandbox

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

redgap

Automated MITRE ATT&CK offense-detection coverage harness - deterministic, no AI in the verdict.

iflow-mcp-m507-ai-soc-agent

Blackhat 2025 presentation and codebase: AI SOC agent & MCP server for automated security investigation, alert triage, and incident response. Integrates with ELK, IRIS, and other platforms.

aisoc-detections

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

aisoc-sdk

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

aisoc-cli

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

aisoc-plugin-sdk

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

azath

Assumed-breach Azure/Entra attack-path analyzer. Read-only collectors build a typed identity graph, deterministic detectors find privilege-escalation paths, and an LLM explains and prioritizes them in plain English.

gitlab-watchman

Finding exposed secrets and personal data in GitLab

basalt-scan

A purple-team of AI agents that audits code security and proves findings by execution — not by opinion.

slack-watchman-eg

Monitoring your Slack Enterprise Grid for sensitive information

cloudsaga

AWS CloudSaga - Simulate security events in AWS

github-watchman

Monitoring GitHub for sensitive data shared publicly

esxi-testing-toolkit

🧰 ESXi Testing Tookit is a command-line utility designed to help security teams test ESXi detections.

stack-overflow-watchman

Monitoring Stack Overflow Enterprise for exposed secrets

trello-watchman

Monitoring your Trello boards for sensitive information