Threat Hunting Python Packages

dnstwist

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

ioc-finder

Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regexes which makes it more readable, maintainable, and hackable. Explore our interactive documentation here: https://hightower.space/ioc-finder/

libre-devops-helpers

🧰 A fast, read-only CLI and Python helpers for Entra ID, Defender XDR, Sentinel, Intune, Azure, Microsoft Graph, PIM, Logic Apps and ServiceNow. The ldo command signs in as you; also shipped as container images.

stix-shifter

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

stix-shifter-utils

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

stix-shifter-modules-splunk

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

google-secops-mcp

Google SecOps MCP server

stix-shifter-modules-elastic-ecs

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

stix-shifter-modules-azure-sentinel

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

agentic-threat-hunting-framework

ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.

firepit

Firepit - STIX Columnar Storage

stix-shifter-modules-stix-bundle

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

malwoverview

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

stix-shifter-modules-qradar

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

stix-shifter-modules-proxy

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

gti-mcp

Google Threat Intelligence MCP server

stix-shifter-modules-azure-log-analytics

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

stix-shifter-modules-qradar-perf-test

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

pybinaryedge

Python 3 Wrapper for the BinaryEdge API https://www.binaryedge.io/

stix-shifter-modules-msatp

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

stix-shifter-modules-carbonblack

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

stix-shifter-modules-error-test

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

stix-shifter-modules-guardium

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

stix-shifter-modules-aws-cloud-watch-logs

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.