Soc Automation Python Packages

rule-doctor-lite

Free read-only check: which custom Wazuh rules never fire, and why (including rules Wazuh drops at load). Python 3, one file.

iocx

An extensible, deterministic static‑analysis engine that extracts high‑signal IOCs from PE binaries and text, built for SOC automation and modern threat‑analysis pipelines.

zettelforge

Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents

iflow-mcp-m507-ai-soc-agent

Blackhat 2025 presentation and codebase: AI SOC agent & MCP server for automated security investigation, alert triage, and incident response. Integrates with ELK, IRIS, and other platforms.