Siem Python Packages

secops

A helper SDK to wrap the Google SecOps API for common security use cases

sigmatools

Main Sigma Rule Repository

pysigma-backend-loki

pySigma backend for generating Grafana Loki/LogQL rules

tenzir

Tenzir is the data pipeline engine for security teams.

cnsl

Security Layer

logsentinelai

LLM-powered security log analyzer: detect threats & anomalies with zero regex — just declare a Pydantic schema. Real-time Telegram alerts, SIEM-ready with Elasticsearch/Kibana. Supports OpenAI, Ollama, vLLM.

splunkctl

CLI tool for Splunk Enterprise SIEM operations — operate Splunk as code

txt2detection

A command line tool that takes a txt file containing threat intelligence and turns it into a detection rule.

agentic-threat-hunting-framework

ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.

logatory

Local log analysis with PII redaction, threat detection, anomaly detection and LLM-powered insights

eventum-generator

Realistic synthetic events for testing, demos, and pipelines — streamed live or generated in bulk

sigmalint-cli

ESLint-style linter for Sigma detection rules. Validates against Sigma 2.1.0, scores rules across six quality dimensions, emits stable rule IDs.

pyvast

Tenzir is the data pipeline engine for security teams.

eis-sigmatools

Tools for the Generic Signature Format for SIEM Systems

ocsfkit

OCSF workbench CLI for normalizing, linting, explaining, diffing, and querying security events

mozdef-util

Utilities shared throughout the MozDef codebase

pysigma-backend-sumologic

pySigma backend for Sumo Logic Cloud SIEM rule conversion

eventum-core

Realistic synthetic events for testing, demos, and pipelines — streamed live or generated in bulk

parse-ioc

Parse a list of indicators into a dictionary or JSON structure for programmatic use.

splint-spl

A fast, zero-dependency linter for Splunk SPL — catch slow searches before they hit production.

vellaveto-sdk

Python SDK for the Vellaveto agent interaction firewall

asp-cli

Agentic SOC Platform: A powerful, flexible, open-source, and agent-centric automated security operations platform (AI SOC)

pytenzir

Tenzir is the data pipeline engine for security teams.

django-audit-wazuh

Django middleware and signals for handling security events