Python Security Automation

A test-driven, standard-library Python toolkit for repetitive defensive-security tasks. It normalizes indicators, streams SHA-256 hashing, and triages saved .eml messages with transparent, review-oriented scoring.

Why this project exists

Analysts regularly move indicators between advisories, tickets, SIEM searches, and block lists while also reviewing suspicious messages. Manual handling is slow and easy to perform inconsistently. This project turns those steps into deterministic automation with explicit safety boundaries and unit tests.

Capabilities

• Refang hxxp and [.] notation and validate IPv4 values.
• Extract and deduplicate URLs, domains, IP addresses, and common hash formats.
• Stream file hashing without loading large evidence files into memory.
• Parse sender, reply-to, SPF, DKIM, DMARC, links, and attachment metadata from .eml.
• Explain every phishing signal and produce a calibrated review priority.
• Emit stable JSON for later, explicitly approved SIEM or SOAR integration.

Run the examples

python -m pip install -e .
security-auto extract sample-data/advisory.txt
security-auto hash sample-data/advisory.txt
security-auto phishing sample-data/suspicious-email.eml
python -m pytest -q

The included email is a harmless synthetic fixture. It uses reserved .test domains and a text-only training attachment.

Review the evidence

• IOC extraction and hashing
• Explainable phishing triage
• Synthetic suspicious email
• Phishing triage playbook
• Automated tests

Engineering and safety choices

• Python standard library only at runtime.
• No URL visits, DNS lookups, enrichment calls, attachment execution, or blocking.
• Verdicts indicate analyst review priority, not a claim that a message is malicious.
• Deterministic sorting and scoring support repeatable output and testing.
• Original message preservation and human verification remain part of the workflow.

Limitations and roadmap

Header results may be missing or untrusted, exact hostname comparisons can flag legitimate redirects, and keyword scoring cannot replace business context. Production use requires approved data sources, mail-gateway context, access controls, logging, labeled-sample evaluation, and measured false-positive rates.

Planned extensions include STIX 2.1 export, allow-listed enrichment adapters, structured logging, and ticket/SIEM connectors with explicit dry-run behavior.

Author

Nicolas Ferrer - Information Systems Security student at SAIT, focused on Python, PowerShell, SOC operations, and security automation.