Threat Detection Python Packages

ftagent

Flowtriq DDoS Detection Agent. Real-time traffic monitoring, incident detection, PCAP capture, and auto-mitigation

agentmetry

Local-first flight recorder for AI coding agents. Hash-chained audit trail, MITRE-mapped sequence detection, DLP. Forwards to the SIEM you already run.

pyatr

Open detection-rule standard for AI agent security threats — like Sigma, but for AI agents. Executable, testable rules for prompt injection, tool poisoning, context exfiltration and MCP attacks. Merged into open-source projects at Microsoft, Cisco, Gen Digital, MISP and FINOS. MIT-licensed.

logsentinelai

LLM-powered security log analyzer: detect threats & anomalies with zero regex — just declare a Pydantic schema. Real-time Telegram alerts, SIEM-ready with Elasticsearch/Kibana. Supports OpenAI, Ollama, vLLM.

gfg-adr-detection

ADR secures enterprise AI agents through observability, security benchmarking, and threat detection. Deployed at Uber.

agentic-threat-hunting-framework

ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.

cnsl

Security Layer CNSL Brain

adr-sensor

ADR secures enterprise AI agents through observability, security benchmarking, and threat detection. Deployed at Uber.

talus-process-monitor

eBPF ransomware detection & response agent for Linux — single static binary, no kernel modules, behavioural scoring, process pause/kill

mcp-server-malcolm

Ask an AI agent about your Malcolm network traffic. MCP server for Zeek, Suricata, Arkime and NetBox data, read-only until you opt in to writes.

pysigma-backend-varpulis

pySigma backend for Varpulis VPL: Sigma rules, correlation rules included, as detection streams

sys-inspector

eBPF-based forensic and security inspection for Linux: live process tree, persistence enumeration and normalized findings mapped to MITRE ATT&CK, in self-contained encrypted reports. https://build.opensuse.org/project/show/home:mariosergiosl:sys-inspector

adrian-sdk

Open-source runtime AI agent security tool - monitors and controls AI agents, catching malicious tool use, prompt injection, and policy drift in real time, before the agent acts.

visionone-filesecurity

Trend Vision One File Security Python SDK

rule-doctor-lite

Free read-only check: which custom Wazuh rules never fire, and why (including rules Wazuh drops at load). Python 3, one file.

fibratus

Security sensor for realtime threat detection and protection

drosera

A carnivorous honeypot for autonomous AI agents. Sweet-looking bait. Sticky ending.

pcaptriage

Automated pcap triage on top of Zeek: MITRE ATT&CK-mapped findings and an HTML report, in one command.

forensic-scan

Forensic AST scanner that detects deliberate obfuscation, hidden logic and payloads smuggled in non-code files

aisoc-sandbox

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

phonsint

🕵️‍♂️ Advanced phone number OSINT suite engineered for silent reconnaissance. Extracts masked emails, profile avatars and uncovers cross-platform account registrations, and enriches identity footprints with zero SMS alerts.

websecprobe

Security testing tool for analyzing HTTP 403 responses and identifying access control misconfigurations in web applications.

hushspec

Portable security rules for the action boundary of AI agents

pysigma-backend-victorialogs

pySigma backend that converts Sigma detection rules to LogsQL queries for VictoriaLogs