Siem Python Packages

secops

A helper SDK to wrap the Google SecOps API for common security use cases

sigmatools

Main Sigma Rule Repository

tenzir

Tenzir is the data pipeline engine for security teams.

pysigma-backend-loki

pySigma backend for generating Grafana Loki/LogQL rules

agentmetry

Local-first flight recorder for AI coding agents. Hash-chained audit trail, MITRE-mapped sequence detection, DLP. Forwards to the SIEM you already run.

wazuhcoverage

A small batch CLI for measuring coverage in Wazuh JSON archives.

logsentinelai

LLM-powered security log analyzer: detect threats & anomalies with zero regex — just declare a Pydantic schema. Real-time Telegram alerts, SIEM-ready with Elasticsearch/Kibana. Supports OpenAI, Ollama, vLLM.

google-secops-mcp

Google SecOps MCP server

pyvast

Tenzir is the data pipeline engine for security teams.

agentic-threat-hunting-framework

ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.

cnsl

Security Layer CNSL Brain

gti-mcp

Google Threat Intelligence MCP server

wazuhtester

wazuhtester is a Python library and command-line tool for interacting with the Wazuh wazuh-logtest daemon.

pysigma-backend-varpulis

pySigma backend for Varpulis VPL: Sigma rules, correlation rules included, as detection streams

pysigma-backend-sumologic

pySigma backend for Sumo Logic Cloud SIEM rule conversion

rule-doctor-lite

Free read-only check: which custom Wazuh rules never fire, and why (including rules Wazuh drops at load). Python 3, one file.

wazuhevtx

A Python tool that parses EVTX files and converts them into JSON formatted logs mimicking Wazuh agent behavior in version 4.x. wazuhevtx is designed as a helper for wazuh-logtest tool.

secops-soar-mcp

Google SecOps SOAR MCP server

scc-mcp

Security Command Center MCP server

secops-mcp

Google SecOps MCP server (official alias for google-secops-mcp)

txt2detection

A command line tool that takes a txt file containing threat intelligence and turns it into a detection rule.

wazuhscatune

A helper for Wazuh Security Configuration Assessment (SCA) to create a custom SCA based on loosening.

wresult

wresult provides the running configuration of a Wazuh agent by reconstructing how it applies ossec.conf and agent.conf.

aisoc-sandbox

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.