$ show target/strelka
Strelka is a real-time, containerized file scanning system designed for threat hunting, detection, and incident response at enterprise scale. It is built with a Go frontend and manager components that handle gRPC client intake, Redis-based task coordination, and response logging (local, Kafka, S3), while Python backend workers execute over 50 file-format scanners. The system uses YARA rules for initial file classification ('taste'), then dispatches files to specialized scanners for metadata extraction, IOC detection, archive extraction, and malware analysis. It supports multiple client modes: oneshot (CLI), filestream (continuous file monitoring), and a Python client. Deployment is via Docker Compose or Kubernetes, with optional Envoy proxy and OpenTelemetry tracing. The architecture follows a microservices pattern: frontend (gRPC server), coordinator (Redis task queue), gatekeeper (dedup cache), manager (Redis management), and backend (Python scanner workers). Scanners are dynamically loaded and configured via YAML, with positive/negative flavor matching. The codebase includes extensive test fixtures and pytest tests for each scanner, CI/CD pipelines, and pre-commit hooks. While the system is production-ready and well-structured, it exhibits some code duplication across archive scanners, deprecated library usage (pylzma, old protobuf), and brittle subprocess calls for password cracking. Overall, it is a strong, maintainable security analysis platform.
The LLM identified 4 files worth highlighting for reuse:
Provides a self-contained module for extracting and validating Indicators of Compromise (IOCs) such as URLs, domains, IPs, email addresses, and credit card numbers. Uses regex and external validators (validators library) with deduplication. Can be extracted and used in any security tool without modification.
A shared module that wraps John the Ripper for cracking encrypted archives and documents (ZIP, Office, 7z). Provides functions like crack_zip, crack_word, and crack_7z with configurable wordlist and brute-force options. Idempotent and parameterized, it can be reused in any Python project needing password recovery.
A Go package for uploading files to S3-compatible storage with configurable bucket, key, and metadata. Includes error handling and retry logic. Can be extracted and used in any Go project requiring S3 uploads, independent of Strelka's internal types.
A standalone binary parser for Windows LNK (Shortcut) files using the 'construct' declarative parsing library. Defines all LNK structures (shell link header, link target ID list, extra data blocks) in a clean, reusable manner. Can be extracted and used in any Python project needing LNK file analysis without dependencies on the rest of Strelka.