Pinned Loading

1. nmap-network-recon nmap-network-recon Public

   Active reconnaissance toolkit — 3 custom NSE scripts including a post-quantum TLS probe, an Nmap XML to SIEM parser with scan diffing, purple-team detection coverage against companion IDS/SIEM proj…

   Python 1

2. threat-intel-enricher threat-intel-enricher Public

   Async Python threat-intel pipeline — enriches IDS alerts and scan findings against AbuseIPDB, OTX, URLhaus, CISA KEV and EPSS, scores them, and exports STIX 2.1 bundles. 89% coverage, mypy strict, …

   Python

3. suricata-ids-rules suricata-ids-rules Public

   Suricata IDS lab — 23 custom detection rules with MITRE ATT&CK metadata, JA4 fingerprinting, Encrypted Client Hello and post-quantum TLS detection, false-positive tuning, and engine-validated detec…

   Shell

4. splunk-siem-analysis splunk-siem-analysis Public

   Splunk SIEM detection engineering on 33.4M BOTSv1 events — Risk-Based Alerting, contentctl detection-as-code with CI-built app, CIM/tstats detections mapped to MITRE ATT&CK, and Suricata EVE ingest.

   1

5. wireshark-threat-detection wireshark-threat-detection Public

   Network threat detection lab — Encrypted Client Hello, post-quantum TLS, JA4 fingerprinting, DNS tunneling, C2 beaconing, AI/MCP egress. Sigma rules, SOC playbooks, and CI-validated detection-as-code.

   Shell