n0mad1k
176da06dc9
- credential_db: Central credential store with dedup, hashcat/CSV/JSON export, crack tracking - topology_mapper: Network graph from HOST_DISCOVERED/VLAN_DETECTED events, Graphviz DOT/SVG output - net_intel: Beacon detection (stddev/mean analysis), comm graph, DNS tunneling, service deps - user_timeline: Per-user activity timelines, work hours, admin/service account identification - supply_chain_detect: Passive detection of PyPI/npm mirrors, WSUS, CI/CD, SCCM, container registries - change_detector: Continuous baseline diff for burn detection, scan/security tool alerts - security_posture: EDR/SIEM/NAC/honeypot/scanner detection by DNS/port/UA, risk gating - operator_audit: Append-only HMAC chain audit log for engagement deconfliction - tool_output_parser: Unified parser for bettercap events, Responder logs, mitmproxy flows
24 lines
797 B
Python
24 lines
797 B
Python
"""BigBrother intelligence modules — on-device analysis and data aggregation."""
|
|
|
|
from modules.intel.credential_db import CredentialDB
|
|
from modules.intel.topology_mapper import TopologyMapper
|
|
from modules.intel.net_intel import NetIntel
|
|
from modules.intel.user_timeline import UserTimeline
|
|
from modules.intel.supply_chain_detect import SupplyChainDetect
|
|
from modules.intel.change_detector import ChangeDetector
|
|
from modules.intel.security_posture import SecurityPosture
|
|
from modules.intel.operator_audit import OperatorAudit
|
|
from modules.intel.tool_output_parser import ToolOutputParser
|
|
|
|
__all__ = [
|
|
"CredentialDB",
|
|
"TopologyMapper",
|
|
"NetIntel",
|
|
"UserTimeline",
|
|
"SupplyChainDetect",
|
|
"ChangeDetector",
|
|
"SecurityPosture",
|
|
"OperatorAudit",
|
|
"ToolOutputParser",
|
|
]
|