Threat Detection Python Packages

ftagent

Flowtriq DDoS Detection Agent. Real-time traffic monitoring, incident detection, PCAP capture, and auto-mitigation

cnsl

Security Layer

logsentinelai

LLM-powered security log analyzer: detect threats & anomalies with zero regex — just declare a Pydantic schema. Real-time Telegram alerts, SIEM-ready with Elasticsearch/Kibana. Supports OpenAI, Ollama, vLLM.

agentic-threat-hunting-framework

ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.

logatory

Local-first log analysis with PII redaction, threat detection, anomaly detection and LLM insights — CLI, web dashboard and REST API

adrian-sdk

Open-source runtime AI agent security tool - monitors and controls AI agents, catching malicious tool use, prompt injection, and policy drift in real time, before the agent acts.

visionone-filesecurity

Trend Vision One File Security Python SDK

pyatr

Open detection standard -- like Sigma, but for AI agents. 425 rules, shipped in Microsoft AGT, Cisco AI Defense, MISP, OWASP A-S-R-H. 97.1% recall on NVIDIA garak. NIST OSCAL Path 1.

websecprobe

Security testing tool for analyzing HTTP 403 responses and identifying access control misconfigurations in web applications.

ftagent-lite

Lightweight open-source DDoS traffic monitor — stdout output, no account required

lyrebird-emulator

Modern async-first internet-services emulation suite for malware-analysis labs — a defensive INetSim successor with detection telemetry (paired Sigma rules + analytics) as a first-class output.

agentfortress

Runtime protection and security monitoring for AI agents — The CrowdStrike for AI Agents

atlas4d

Self-hosted 4D spatiotemporal AI platform built on PostgreSQL, PostGIS, TimescaleDB, H3 and pgvector, with anomaly & threat detection, NLQ interface and full observability.

simple-dns-poisoning-detector

The DNS Poisoning Detector is a Python-based tool designed to monitor DNS traffic, detect potential DNS poisoning attacks, and generate detailed PDF reports of its findings.

stihia

Python SDK for the Stihia real-time threat detection API for AI systems.

malwar

Static analysis engine for detecting malware in agentic AI skill files

yara-gen

Generate YARA rules automatically from positive and negative examples. For PII detection, secret scanning, and prompt injection.

mcpscope

Unified MCP/A2A security scanner dashboard

yaramint

Generate YARA rules automatically from positive and negative examples. For PII detection, secret scanning, and prompt injection.

pysigma-backend-victorialogs

pySigma VictoriaLogs (LogsQL) backend

iocx-registry-keys

High-performance iocx plugin for detecting Windows Registry keys, values, and persistence locations.

sundewsh

A carnivorous honeypot for AI agents. Every deployment generates a unique persona so no two instances look alike. Detects, fingerprints, and classifies autonomous agent attacks in real time.

hushspec

Portable specification for AI agent security rules

sentinelforge

Autonomous AI Cyber Defense Agent Framework — LangGraph-powered SOC automation with constitutional safety guardrails