seanmcfeely Goto Github PK

ace

Analysis Correlation Engine

ace-metrics

A lib for measuring ACE based IDR operations

ace-reporter

Some code I wrote to automate periodic ace metric reporting.

ace2-ams

ace2-core

An upgrade to the ACE project I was working on at one point.

anyrunapi

ANY.RUN Malware Hunting Service API tool.

asset-tracking

businesstime

A simple python utility for calculating business time aware timedeltas between two datetimes

cbinterface

command line tool for interfacing with multiple carbonblack environments to perform analysis and live response functions

cloudphishlib

simple library for common ACE cloudphish engine calls

custom_splunk_based_ace_modules

Splunk based ACE correlation modules for custom use cases.

eventsentry

A suite of tools that parses intel from phish, sandbox reports, and other artifacts to create analyst-friendly wiki writeups.

falcon-sandbox

Python client library and command line tool for the Falcon Sandbox API

gglsbl-rest-client

Simple python client for the gglsbl-rest service.

ip-inspector

IP inspector is an IPv4 and IPv6 address metadata enricher and tracking tool. Use it on the command line and leverage it as a library.

lerc

A client to help with live response collection

pottery

Redis for humans. 🌎🌍🌏

pysocksipychain

Modified socks.py which supports chained proxies

python-sandboxapi

Minimal, consistent Python API for building integrations with malware sandboxes.

rotl

secimport

Secure import for python modules using dtrace

sip-cofense-collector

sip-indicator-management

sip-threatfox-collector

ThreatFox intel collector for the Simple Intel Platform.

sipcbrace

Search Carbon Black Response for SIP indicators based on indicator criteria. Alerts sent to the ACE platform.

sipit

command line interface for adding indicators and querying different aspects of SIP

sipwhitelist

Library that interacts with SIP to build an indicator whitelist system.

threatfox

Python library and command line tool for interacting with the ThreatFox API.

urlfinderlib

Python library for finding and validating URLs in documents and arbitrary data

urlscanio

CLI tool which uses URLScan to scan websites and download corresponding screenshots and DOMs.