HAITI (HAsh IdenTIfIer) is a Ruby library and CLI tool for identifying hash types from input strings. It matches against a comprehensive database of over 675 hash types (including modern algorithms like SHA3, Blake2, and VeraCrypt) using regex patterns. The library provides concise output with hashcat mode numbers, John the Ripper format names, and example hashes. Multiple CLI entry points exist: the main `haiti` command, `haiti-parsable` for script-friendly output, `haiti-fzf` for interactive selection, and `hashcat-haiti`/`john-haiti` for converting hashes into hashcat/JtR formats. The codebase is well-structured, with clean separation between the identification engine, data definitions, and CLI wrappers. It includes comprehensive documentation (man pages, YARD API docs, a docsify site) and is packaged for numerous Linux distributions and Homebrew. The identification logic is straightforward but effective: iterate over a JSON array of prototypes, apply each regex to the input, and return matching types. The data file (`prototypes.json`) is manually maintained and extended with each release.
OpenCTI is an open-source cyber threat intelligence platform that ingests, manages, and analyzes threat data using the STIX 2.0/2.1 standard. The system is a monorepo containing a Node.js/TypeScript GraphQL backend (opencti-graphql), a React/Relay frontend (opencti-front), a Python client library (client-python), and a Python worker service (opencti-worker). The backend uses Elasticsearch/OpenSearch as its primary data store, Redis for caching and pub/sub, RabbitMQ for connector queues, and PostgreSQL for migrations. The frontend provides full CRUD UIs, dashboards, workspaces, playbook automation, and workflow management. Key entry points include the GraphQL API (resolvers per entity type), the frontend React app with Relay data fetching, and the Python client for programmatic access. Data flows involve ingestion via CSV/JSON/TAXII/RSS feeds, manual creation, connector enrichment, and inference rules that automatically derive relationships. External dependencies include Elasticsearch, Redis, RabbitMQ, MinIO/S3 for file storage, and optional AI services. The platform supports enterprise features (playbooks, PIR, XTM Hub) gated by license checks.
This is an educational repository of Python scripts, mini-projects, and markdown guides for building LLM-based AI agents applied to cybersecurity. The code is organized into five progressive parts: foundational LLM/embeddings usage, prompt templates, prompt chaining, RAG over security data, and agentic workflows. It demonstrates multiple agent frameworks (LangChain, LangGraph, CrewAI, DeepAgents) and MCP server integrations for tools like nmap and Shodan. The dominant character is application/tutorial code rather than data research, although it bundles small datasets (CVE embeddings, sample RAG corpora) and commits Chroma vector stores for offline exercises. The repo is not a single deployable service; it is a collection of entry-point scripts and small frameworks. Architecture is a set of standalone examples with shared patterns: state graphs for orchestration, YAML-configured crews, MCP adapters, and RAG ingestion/query pipelines. Most scripts require OpenAI-compatible API keys and/or local tools such as nmap/Ollama. Simulated data and placeholder responses in some examples make it a learning environment rather than production security tooling. Maintenance is current but drift is moderate: some examples use deprecated langchain vectorstore imports, documentation is duplicated across subdirectories, several referenced files are missing, and hardcoded model strings like gpt-5.4-mini appear dated or fictional. There is no root-level automated test suite; only the Shodan MCP subproject contains tests. The strongest reusable patterns are the MCP server wrapping, LangGraph conditional-state orchestration, CrewAI declarative crew configuration, and the hierarchical SOC agent supervisor.