A simple python script that generate platform-specific queries (e.g., AQL, Elasticsearch, Defender) from input lists of IP addresses, domain names, or file hashes to identify first point of contact.
This tool helps analysts quickly identify rules related to a particular service (e.g., Apache Kylin, MySQL) by scanning the msg field in alert definitions in rule sets for intrusion detection systems like Suricata and Snort.
This Python tool analyzes and classifies Suricata rules by detecting key signature types such as hex patterns, string matches, PCREs, and file hashes.
Generate platform-specific queries (QRadar, Elastic, Defender) from IPs, domains, or hashes to speed up your threat hunting workflow.
Automate Your Way into the Attack Surface.
Understanding the wide number of rules in categories in IDS systems
