Soc Python Packages

libre-devops-helpers

🧰 A fast, read-only CLI and Python helpers for Entra ID, Defender XDR, Sentinel, Intune, Azure, Microsoft Graph, PIM, Logic Apps and ServiceNow. The ldo command signs in as you; also shipped as container images.

tenzir

Tenzir is the data pipeline engine for security teams.

pyvast

Tenzir is the data pipeline engine for security teams.

talus-process-monitor

eBPF ransomware detection & response agent for Linux — single static binary, no kernel modules, behavioural scoring, process pause/kill

mcp-server-malcolm

Ask an AI agent about your Malcolm network traffic. MCP server for Zeek, Suricata, Arkime and NetBox data, read-only until you opt in to writes.

pysigma-backend-varpulis

pySigma backend for Varpulis VPL: Sigma rules, correlation rules included, as detection streams

rule-doctor-lite

Free read-only check: which custom Wazuh rules never fire, and why (including rules Wazuh drops at load). Python 3, one file.

defaultcreds-cheat-sheet

One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️

pcaptriage

Automated pcap triage on top of Zeek: MITRE ATT&CK-mapped findings and an HTML report, in one command.

aisoc-sandbox

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

alertlogic-mcp

MCP server for Alert Logic MDR — AI-powered incident response, SQL log search, SOAR automation, and SOC workflows via Claude

phishsage

CLI toolkit for email phishing analysis. Parses .eml files, runs heuristic checks on headers, links, and attachments, and outputs structured JSON.

falcon-mcp-extended

MCP server for CrowdStrike Falcon — AI-powered threat hunting, EDR investigation, RTR, and SOC automation via Claude

iflow-mcp-m507-ai-soc-agent

Blackhat 2025 presentation and codebase: AI SOC agent & MCP server for automated security investigation, alert triage, and incident response. Integrates with ELK, IRIS, and other platforms.

aisoc-detections

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

aisoc-sdk

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

aisoc-cli

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

aisoc-plugin-sdk

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

soc-agent-toolkit

AI-assisted SOC alert triage and incident analysis toolkit for the command line.

naps

An experiment for building gateware for the axiom micro / beta using amaranth-hdl

pytenzir

Tenzir is the data pipeline engine for security teams.

edaac

EDA Analytics Central

franki-cli

AI-powered terminal CLI for developers & security pros. Free multi-provider fallback, pentest workflows, MITRE mapping.

kestrel-sgr

Autonomous Phishing Control System (APCS) — multi-plane security governance runtime that detects, analyzes, predicts, and neutralises social-engineering threats. OPA Rego policies, 26-node DAG, threat-intel integrations, and a live dashboard.