Strelka is a real-time, containerized file scanning system designed for threat hunting, detection, and incident response at enterprise scale. It is built with a Go frontend and manager components that handle gRPC client intake, Redis-based task coordination, and response logging (local, Kafka, S3), while Python backend workers execute over 50 file-format scanners. The system uses YARA rules for initial file classification ('taste'), then dispatches files to specialized scanners for metadata extraction, IOC detection, archive extraction, and malware analysis. It supports multiple client modes: oneshot (CLI), filestream (continuous file monitoring), and a Python client. Deployment is via Docker Compose or Kubernetes, with optional Envoy proxy and OpenTelemetry tracing. The architecture follows a microservices pattern: frontend (gRPC server), coordinator (Redis task queue), gatekeeper (dedup cache), manager (Redis management), and backend (Python scanner workers). Scanners are dynamically loaded and configured via YAML, with positive/negative flavor matching. The codebase includes extensive test fixtures and pytest tests for each scanner, CI/CD pipelines, and pre-commit hooks. While the system is production-ready and well-structured, it exhibits some code duplication across archive scanners, deprecated library usage (pylzma, old protobuf), and brittle subprocess calls for password cracking. Overall, it is a strong, maintainable security analysis platform.
This repository is a comprehensive catalog of containerized AI agents for scientific computing, primarily in chemistry, biology, materials science, and engineering domains. It includes over 40 agents (e.g., AutoDock Vina, AlphaFold, OpenFOAM, GWP predictor) each packaged as a Docker container with a utility module, example inputs, and tests. The platform also provides a Python CLI tool (`discovery`) for submitting jobs to an Azure-based HPC service, managing storage, and monitoring job status. The repository is hybrid in nature, containing both production-ready application components (CLI, agent deployment infrastructure) and research artifacts (training pipelines for the GWP predictor, model weights, and data ingestion scripts). The agent architecture follows a consistent pattern: each agent has a `quick_setup`/`save_final_results` lifecycle and is designed to run in a containerized environment with mounted `/input` and `/output` directories. The CLI is well-structured with Typer and Rich, and includes extensive tests. However, the codebase exhibits significant duplication (e.g., `molecular_utils.py` and `io_utils.py` appear identically in multiple agents) and some hardcoded paths, which reduces maintainability. The GWP predictor training pipeline is a notable research component with a multi-step ETL process and active learning, but it is tightly coupled to specific external data sources. Overall, the repository serves as a strong foundation for deploying scientific AI agents on Azure, with moderate reusability of individual components.