Python for Blue Team

A collection of Python resources geared towards Blue Team security work.

Think scripts, tutorials, modules, etc.

Main reason for this repo is a collective overview of all things Python available to Blue Teamers.

Will be expanded in the near future.

Repo scripts

• Packet2Snort

Linked scripts

• freq.py
• domain_stats.py
• freq_server.py

Books

• Machine Learning and Security, Protecting Systems with Data and Algorithms, Clarence Chio & David Freeman

• Python for Data Analysis, Data Wrangling With Pandas, Numpy, and Ipython, Wes Mckinney

Libraries

• BAT (Bro Analysis Tools), used for processing Bro logs in Python https://github.com/SuperCowPowers/bat pip install bat

• Scapy, used for processing and manipulating raw network data in Python pip install scapy

• Pandas, used for processing a variety of log data in differing formats pip install pandas

• Matplotlib, used for visualizing data in Python pip install matplotlib