Threat Intelligence Python Packages

pycti

Open Cyber Threat Intelligence Platform

dnstwist

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

bbot

The recursive internet scanner for hackers. 🧡

flare-capa

The FLARE team's open-source tool to identify capabilities in executable files.

iocextract

Defanged Indicator of Compromise (IOC) Extractor.

ioc-finder

Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regexes which makes it more readable, maintainable, and hackable. Explore our interactive documentation here: https://hightower.space/ioc-finder/

anyrun-sdk

Simplify integration with ANY.RUN REST API services

user-scanner

🕵️‍♂️ (2-in-1) Email & Username OSINT suite for deep data extraction. Analyzes 290+ scan vectors (105+ email / 185+ username) for security research, investigations, and digital footprinting.

greynoise

Python3 library and command line for GreyNoise

pysafebrowsing

Python 3 Google Safe Browsing library

stix-shifter

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

ail-typo-squatting

Generate list of potential typo squatting domains with domain name permutation engine to feed AIL and other systems.

stix-shifter-utils

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

stix-shifter-modules-splunk

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

ftagent

Flowtriq DDoS Detection Agent. Real-time traffic monitoring, incident detection, PCAP capture, and auto-mitigation

openosint

AI-powered OSINT agent with interactive REPL, MCP server, and CLI. 16 tools. Works with Claude, GPT-4, or local models. For authorized security research only.

is-crawler

Crawler detection from User-Agent strings in 50 ns. Issues and pull requests welcome!

firepit

Firepit - STIX Columnar Storage

stix-shifter-modules-elastic-ecs

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

stix-shifter-modules-azure-sentinel

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

stix-shifter-modules-qradar

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

csirtg-indicator

The FASTEST way to create indicators!

stix-shifter-modules-stix-bundle

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

stix-shifter-modules-msatp

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.