EmailAnalyzer is a command-line application for analyzing suspicious email files (.eml). It extracts headers, links, attachments, digests (hashes), and authentication results (SPF/DKIM/DMARC) from email messages. The tool provides investigation features that generate links to threat intelligence services (VirusTotal, AbuseIPDB, URLScan) for indicators of compromise found in emails. Output can be displayed in the terminal or saved as JSON or HTML reports. The architecture is modular with separate functions for each analysis component, all depending only on the Python standard library, making them highly reusable.
This repository is the infrastructure-as-code backbone for Security Onion, a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. It contains over 1,700 files of SaltStack states, Jinja templates, shell scripts, and Python modules that orchestrate the deployment, configuration, and lifecycle management of a distributed grid of security monitoring nodes. The code manages the entire Elastic Stack (Elasticsearch, Logstash, Kibana), network sensors (Zeek, Suricata), file analysis (Strelka), endpoint monitoring (Elastic Fleet/Agent), authentication (Kratos/Hydra), messaging (Kafka/Redis), metrics (Telegraf/InfluxDB), and the Security Onion Console (SOC) web UI. It is not a standalone application but a deployment and configuration system that transforms a bare OS into a fully operational security operations center. The repository is actively maintained with frequent commits, versioned releases, and a large community. Key architecture patterns include role-based state inclusion via `allowed_states`, consistent Docker container management, Jinja-based configuration merging, and event-driven reactors for rule pushes. Notable reusable components include a self-contained threat intelligence analyzer framework, a YAML manipulation CLI tool, and polling-based beacons that avoid inotify leaks.
This repository is a curated, bilingual (English/Chinese) OPML feed collection focused on cybersecurity and AI, containing approximately 1000+ RSS/Atom feed URLs organized into 12 categories (e.g., Crypto, Pwn, WebSecurity, MobileSecurity, AI). It serves as the data backbone for a personal intelligence pipeline, designed to feed into AI-curated daily security digests. The repo includes automation scripts for feed health monitoring (opml_sync.py with HTTP retries, gzip/deflate decoding, and stateful failure tracking), interactive feed addition (add_feed_to_tiny.py), and optional LLM-assisted pruning (prune_opml.py). A GitHub Actions workflow runs sync operations on push and validates PRs. The actual value lies in the carefully vetted list of high-quality security sources, including many from the Chinese security community, with automated dead-link detection and deduplication. The scripts are well-structured and testable, but the repository's primary deliverable is the curated data, not the application logic.
This repository is a static data collection of malware indicators of compromise (IOCs) organized by APT threat actor. It contains no application code, scripts, or executable logic; the content is entirely markdown files, each holding a consistent five-column table (Hash, Type, Family, First_Seen, Name) with VirusTotal links. The data spans roughly 2007-2025 and covers file types including PE executables, documents, Android APKs, ELF binaries, and LNK files. The directory structure groups hashes by actor, making the markdown tables the primary entry points for IOC lookup or ingestion.