integraldefense Goto Github PK

ace

Analysis Correlation Engine

ace_client_lib

ACE client library - used to submit alerts to ACE from external systems

alb_cert_update

amc

ACE mailbox client - part of the ACE system that sends received emails to ACE

brocess

A daemon to summarize bro network activity into a MySQL database.

brotail

A daemon that tails the bro logs and scans each entry for matches to data exported from CRITS.

brotex

(deprecated) A system to use Bro to collect and scan emails.

brotex_client

A bro-based system to collect emails and files downloaded via HTTP for analysis.

cbinterface

command line tool for interfacing with multiple carbonblack environments to perform analysis and live response functions

chronos

A python daemon to execute long running processes.

cloudphishlib

simple library for common ACE cloudphish engine calls

crits_exports

export crits data to yara, ssdeep, and csv/splunk lookup table formats

crits_splunk_detect

operationalize your indicators of compromise, and send alerts/matches to ACE

critsapi

critswhitelist

Python library that interacts with CRITS to build an indicator whitelist system.

elk_hunter

A daemon to execute ElasticSearch queries and create ACE alerts based on the results.

eventsentry

A suite of tools that parses intel from phish, sandbox reports, and other artifacts to create analyst-friendly wiki writeups.

exchangelib

Python client for Microsoft Exchange Web Services (EWS)

faqueue

test the indicators from your intel management system prior to deploying them, send alert to ACE when needed

getitintocrits

icrt

Windows C# Gui Implementation of the Carbon Black Response feature set.

integraldefense.github.io

json-inspect

An experimental tool to compare and flatten JSON-formatted logs for SIEM ingestion.

netskope_log_fetcher

Script to pull down netskope logs.

o365_log_fetch

Tool to fetch and log O365 Management Activity API logs in a SIEM-friendly json format.

otx2crits

Subscribe to Alienvault OTX feeds and automatically import them into CRITs events

pcap_extract

A simple python utility to extract a timeframe of pcap matching a given bpf from a network sensor that is collecting pcap.

phishfry

python library for removal of emails

phishremover

A windows service that listens for REST commands to remove and restore emails in Office 365 using EWS.

ptauto

Scripts and automation for PassiveTotal and CRITs