Security Intelligence Tools

35 built-in tools across Red Team, Blue Team, Purple Team, and AI-Native categories. All cosign-signed, hot-loadable, zero-restart deployment.

Built-In Tools

🔴 Red Team (5 tools)

🔍NexusProbeRED

Advanced recon with AI target profiling, subdomain discovery, and port scanning.

👻PhantomScanRED

Stealth scanner with evasion techniques and rate-limited discovery.

🌐ShadowDNSRED

DNS covert channel detection and DNS tunneling analysis.

🕸️GhostHTTPRED

HTTP fingerprinting and web application reconnaissance.

📡C2ProfilerRED

Command and control infrastructure profiling and attribution.

🔵 Blue Team (9 tools)

📊SentinelBaselineBLUE

Behavioral baseline monitoring with 3.2σ anomaly detection.

⚡LogForgeBLUE

Sigma rule generation and SIEM log analysis engine.

🍯HoneyWireNetBLUE

SSH honeypot with attacker profiling and 313-BIND receipts.

🔐VaultScanBLUE

Secret detection across 18 pattern types with SARIF output.

🔬ForensicTracerBLUE

Digital forensics and artifact collection with chain of custody.

☁️CloudAuditBLUE

AWS, Kubernetes, and Terraform security hardening checks.

🛡️KernelIntegrityMonitorBLUE

eBPF-based kernel integrity monitoring and syscall analysis.

🎭DeceptionEngineBLUE

WE-FORGE lure deployment and CADL escalation management.

🔒ZeroTrustBLUE

Zero-trust network access enforcement and identity verification.

🟣 Purple Team (8 tools)

⚛️AtomicChainPURPLE

Atomic red team test execution with detection validation.

🔨DetectionForgePURPLE

Sigma rule generation from ATT&CK technique mappings.

📈CoverageMatrixPURPLE

ATT&CK coverage visualization — 136/265 techniques (51.4%).

🔄ThreatReplayPURPLE

Historical threat replay for detection rule validation.

🎯AdversaryEmulatorPURPLE

APT29, APT41, Lazarus, FIN7 adversary emulation profiles.

🔗SupplyChainAuditorPURPLE

SLSA provenance verification and supply chain risk analysis.

🗺️LateralMovementTrackerPURPLE

Lateral movement path analysis and pivot point detection.

🏹ThreatHunterPURPLE

Hypothesis-driven threat hunting with IOC correlation.

🤖 AI-Native (13 tools)

🧠NexusRAGAI

ChromaDB RAG with 5 knowledge namespaces — CVE, MITRE, OWASP, session, general.

📝ThreatNarratorAI

AI-generated threat intelligence narratives from raw findings.

⚙️RuleSmithAI

AI-powered Sigma and YARA rule generation from TTPs.

💡ExplainCVEAI

Plain-language CVE explanation with EPSS scoring and KEV status.

🌐ThreatIntelligenceAI

Multi-feed TI aggregation — FeodoTracker, URLhaus, MalwareBazaar, OTX.

🦠MalwareAnalyzerAI

Static and behavioral malware analysis with YARA pattern matching.

💾MemoryForensicsAI

Memory dump analysis and process injection detection.

🏹AegisHunterAI

AI-driven threat hunting with Markov chain pivot prediction.

🔮PalantirBridgeAI

Palantir Ontology integration — LureDocument, Adversary, Device objects.

📊BehavioralGraphEngineAI

NetworkX intelligence graph with 9 node types and risk ranking.

⚛️QuantumThreatScorerAI

HNDL risk scoring and CRQC timeline threat assessment.

🔧AdaptiveRuleEngineAI

Self-tuning detection rules based on analyst feedback loops.

🧬ThreatDNAProfilerAI

Threat actor fingerprinting via behavioral DNA analysis.

Build Your Own Plugin

Use the Shadow313 SDK to create custom tools. All plugins are cosign-signed and hot-loadable without restart.

pip install shadow313-sdk

View SDK Documentation →