Tools & Automation
Production tools built for real threat hunting operations.
Production tools built for real threat hunting operations -- not side projects, operational infrastructure.
Threat Inquiry Pipeline
Multi-Agent AI Threat Triage Automation
Multi-version AI pipeline system for automating the full threat inquiry lifecycle. The latest version uses an 11-agent architecture with phase quality gates, parallel enrichment, and agent metrics — covering intake, OSINT, IOC enrichment, detection coverage, response drafting, visual generation, and documentation publishing. Runs autonomously from email to published report.
Threat Intelligence Platform
Unified TI Analysis & Reporting Dashboard
Full-featured platform that curates cybersecurity RSS feeds, news, and articles into actionable intelligence. Generates concise reports from single or multiple sources, extracts IOCs, verifies detection coverage, produces CTI-ready JSON output with hunting queries, and auto-publishes to the team wiki — all in one workflow.
Infrastructure Hunting Toolkit
Adversary C2 & Infrastructure Mapping System
Methodology and tooling for adversary infrastructure identification using Shodan, Censys, FOFA, and passive DNS. Maps C2 servers through SSH key pivoting, SSL certificate analysis, HTTP header fingerprinting, ASN attribution, and cloud provider mapping — turning network artifacts into threat actor attribution.
Security Automation Suite
Purpose-Built Tools for Analysis, Reporting & Documentation
Collection of purpose-built tools covering RAG-powered report generation, malware-as-a-service analysis, PowerPoint threat brief analysis, AI chatbot for threat queries, BEC investigation workflows, and security log analysis — each automating a recurring analyst task.
CTI Platform Connector
AI-to-Threat-Intelligence Bridge
Model Context Protocol server that connects AI assistants directly to a production threat intelligence platform, enabling natural language queries against indicators, campaigns, relationships, and labels — bridging the gap between AI tooling and operational threat data.
Security Data Lake Platform
Databricks-Powered Threat Intelligence Search Dashboard
Web-based threat intelligence search platform built on Databricks that queries large-scale security telemetry in real time. Features a FastAPI REST backend, an interactive web dashboard, and MCP-connected analyst tools for searching IP addresses, file hashes, domains, URLs, email indicators, detections, and event prevalence across multiple security datasets.
Autonomous AI Dev Platform
Multi-Model AI Pipeline & Development Orchestration System
Desktop platform for orchestrating autonomous AI development pipelines across a large pool of models from multiple providers. Includes multi-model routing with cost governance, event-driven triggers, safety guardrails, session persistence, and real-time streaming — capable of running end-to-end pipelines that plan, implement, test, and document code without manual intervention.
Every tool here was born from a real threat hunting workflow pain point -- from inquiry triage and infrastructure hunting to threat intelligence analysis and report generation.