Incident Response Python Packages

volatility3

Volatility 3.0 development

cortexutils

Cortex Analyzers Repository

tenzir

Tenzir is the data pipeline engine for security teams.

gitgalaxy

An AST-free, LLM-free heuristic knowledge graph engine for deep repository intelligence. Map, secure, and modernize enterprise codebases across 50+ languages at extreme velocity

projectair

Project AIR: forensic reconstruction and incident response for AI agents. Signed AgDR decision records, OWASP ASI01-ASI10 detection, signed forensic evidence exports.

firefighter-incident

FireFighter is an incident management application, designed to work in Slack, and more.

intelmq

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

cortex4py

Python API Client for Cortex

apiosintds

On demand query API for https://github.com/davidonzo/Threat-Intel project.

pyvast

Tenzir is the data pipeline engine for security teams.

chickadee

Yet another IP address enrichment tool

lerc-control

A client to help with live response activities

resq-mcp

FastMCP server exposing ResQ platform capabilities to AI clients

ransomwatch

ransomwatch is a Python based tool designed for ransomware threat intelligence and security research.

django-incident-response

Monzo's real-time incident response and reporting tool ⚡️

quell

Open-source multi-agent incident response. Watches logs, investigates in a Docker sandbox, drafts a PR that humans always merge.

luminaut

Casting light on shadow cloud deployments

apple-notes-forensics

Copy-first Apple Notes recovery and review toolkit for macOS, with AI-assisted triage, evidence-backed case Q&A, and a read-mostly MCP server for Codex / Claude Code style local agent workflows.

octantis

Intelligent infrastructure monitoring agent for EKS/K8s

sem-emergency-stop

Quickly stop all Google Ads advertising

phishsage

PhishSage is a lightweight email triage and phishing-analysis toolkit. Extracts headers, attachments, and links, applies heuristic checks, and produces structured insights.

vindicara

Project AIR: forensic reconstruction and incident response for AI agents. Signed AgDR decision records, OWASP ASI01-ASI10 detection, signed forensic evidence exports.

pytenzir

Tenzir is the data pipeline engine for security teams.

bedrock-keys-security

Detect phantom IAM users, decode leaked AWS Bedrock API keys, and prevent LLMjacking. CLI + SCPs + SIEM detection rules.