mgetzem / sooty

The SOC Analysts all-in-one CLI tool to automate and speed up workflow.

Sooty

The SOC Analysts all-in-one CLI tool to automate and speed up workflow.

Sooty can Currently:

• Sanitise URL's to be safe to send in emails
• Perform reverse DNS and DNS lookups
• Perform reputation checks from VirusTotal
• Check if an IP address is a TOR exit node
• Decode Proofpoint URL's and UTF-8 encoded URLS
• Get file hashes and compare them against VirusTotal (see requirements)
• Perform WhoIs Lookups

Requirements

• Python 3.x
• To use the Hash comparison with VirusTotal requires an API key, replace the key in the code with your own key.

Contributors:

• Aaron J Copley for his code to decode ProofPoint URL's
• James Duarte for adding a hash and auto-check option to the hashing function