python-security-tools - Python-based cybersecurity tools and scripts for s

项目说明

Python Security Tools

Analyst & De: Millie Altman

!Python
!CTI Tooling
!Phishing Detection
!IOC Enrichment
!AbuseIPDB
!OSINT

Focus: CTI Analyst Tooling | Phishing Detection | IOC Enrichment | OSINT Automation
Language: Python 3.x

---

O

Python tools built to automate analyst workflows in cyber threat intelligence and security operations. Each tool addresses a specific in problem — reducing manual effort, accelerating triage, and producing structured output suitable for documentation and reporting.

Tools are de iteratively, reflecting a real-world de lifecycle from prototype to in utility. All tools are built around CTI and SOC analyst use cases.

---

Tool Index

| Tool | Problem It Solves | |
|---|---|---|
| Phishing URL Analyzer | Automates URL risk scoring and domain intelligence during phishing triage | v3 |
| Email Header Analyzer | Automates SPF/DKIM/DMARC inspection and sender infrastructure analysis | v1 |
| IP Enrichment Tool | Automates AbuseIPDB reputation lookups against suspicious IPs observed in SIEM alerts | v1 |

---

Phishing URL Analyzer

Problem: Phishing triage requires manual inspection of URLs for risk indicators — a repetiti that benefits from automation.

Solution: Parses URLs, scores phishing risk indicators, queries WHOIS for domain registration age, and produces structured in output formatted for analyst reporting.

CTI Application: Used in the Phishing Campaign Intelligence Report to analyze a credential har URL during in SOC-IR-2026-017.

→ phishing-url-analyzer/

---

Email Header Analyzer

Problem: Manual email header inspection — checking SPF, DKIM, DMARC, sender/return-path mismatches, and originating IPs — is error-prone and slow at .

Solution: Parses raw email headers, e authentication results, flags domain mismatches between From and Return-Path fields, and extracts public IPs from the recei.

CTI Application: Used in the Phishing Campaign Intelligence Report to confirm spoofed sender infrastructure during in SOC-IR-2026-017.

→ email-header-analyzer/

---

IP Enrichment Tool

Problem: Suspicious IPs appear constantly in SIEM alerts, firewall logs, and authentication records. Manual reputation lookups are inconsistent and slow at .

Solution: Queries the AbuseIPDB API in real time and returns a structured reputation report — abuse confidence score, country of origin, and ISP — formatted for direct use in in notes.

CTI Application: De during threat intelligence enrichment operations in the CTI Research Lab to enrich IPs observed in Wazuh SIEM alerts.

→ ip-enrichment-tool/

---

De Philosophy

Analyst-first output — every tool produces output structured for documentation, not just terminal readability. Results should be usable directly in incident reports without reformatting.

Iterati — tools are to reflect real de cycles. The phishing URL analyzer shows deliberate progression from basic detection logic to full in output across three .

CTI-grounded problems — Every tool exists because a real analyst workflow needs to be automated. The problem drives the tool, not the other way around.

---

Planned Tools

| Tool | Problem | Status |
|---|---|---|
| IOC Enrichment Script | Bulk IOC lookup against , AbuseIPDB, and Shodan APIs in a single query | Planned |
| OSINT Domain Profiler | Automates WHOIS, DNS history, and passive DNS lookups for domain in | Planned |
| STIX IOC Formatter | Converts extracted IOCs into STIX 2.1 format for threat intelligence platform ingestion | Planned |
| Threat Feed Aggregator | Pulls and normalizes IOCs from open-source threat feeds (MISP, OTX, URLhaus) | Planned |

---

Setup

Dependencies:

---

Related Repositories

| Repository | Description |
|---|---|
| threat-intelligence-portfolio | Finished intelligence products where these tools were applied |
| threat-actor-profiles | Structured threat actor research and TTP analysis |
| cti-research-lab | Threat research lab where several tools were de and tested |

---

Contact

Open to CTI analyst, threat researcher, and security engineering roles.
Connect on LinkedIn

项目信息

开发语言：Python

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Python-based cybersecurity tools and scripts for security automation, threat detection, log analysis, reconnaissance, and defensive security projects.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。