Metadata-Version: 2.4
Name: soc-toolkit
Version: 7.0.0
Summary: 🛡️ SOC Toolkit v7.0 Global Enterprise Security Suite - Zero-Key VirusTotal/Shodan/AbuseIPDB Engine | EDR Telemetry | Syslog Stream
Author-email: Furkan Dinçer <frkndncr@github.com>
Maintainer-email: Furkan Dinçer <frkndncr@github.com>
License-Expression: MIT
Project-URL: Homepage, https://github.com/frkndncr/soc-toolkit
Project-URL: Documentation, https://github.com/frkndncr/soc-toolkit#readme
Project-URL: Repository, https://github.com/frkndncr/soc-toolkit.git
Project-URL: Issues, https://github.com/frkndncr/soc-toolkit/issues
Keywords: security,soc,threat-intelligence,ioc,cybersecurity,malware,virustotal,abuseipdb,shodan,cli
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Information Technology
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Classifier: Topic :: System :: Networking :: Monitoring
Classifier: Topic :: Utilities
Requires-Python: >=3.8
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: requests>=2.28.0
Requires-Dist: rich>=13.0.0
Provides-Extra: dev
Requires-Dist: pytest>=7.0.0; extra == "dev"
Requires-Dist: black>=23.0.0; extra == "dev"
Requires-Dist: flake8>=6.0.0; extra == "dev"
Dynamic: license-file

<div align="center">

# 🛡️ SOC Toolkit v6.0

```text
███████╗ ██████╗  ██████╗    ████████╗ ██████╗  ██████╗ ██╗     ██╗  ██╗██╗████████╗
██╔════╝██╔═══██╗██╔════╝    ╚══██╔══╝██╔═══██╗██╔═══██╗██║     ██║ ██╔╝██║╚══██╔══╝
███████╗██║   ██║██║            ██║   ██║   ██║██║   ██║██║     █████╔╝ ██║   ██║   
╚════██║██║   ██║██║            ██║   ██║   ██║██║   ██║██║     ██╔═██╗ ██║   ██║   
███████║╚██████╔╝╚██████╗       ██║   ╚██████╔╝╚██████╔╝███████╗██║  ██╗██║   ██║   
╚══════╝ ╚═════╝  ╚═════╝       ╚═╝    ╚═════╝  ╚═════╝ ╚══════╝╚═╝  ╚═╝╚═╝   ╚═╝   
```

### ⚡ Autonomous AI Threat Intelligence & Incident Response Platform

[![Python 3.8+](https://img.shields.io/badge/Python-3.8+-3776AB?style=for-the-badge&logo=python&logoColor=white)](https://www.python.org/)
[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg?style=for-the-badge)](LICENSE)
[![Version](https://img.shields.io/badge/Version-6.0.0-blue?style=for-the-badge)](#)
[![Docker](https://img.shields.io/badge/Docker-Ready-2496ED?style=for-the-badge&logo=docker&logoColor=white)](Dockerfile)
[![Kubernetes](https://img.shields.io/badge/Kubernetes-Ready-326CE5?style=for-the-badge&logo=kubernetes&logoColor=white)](k8s/deployment.yaml)

</div>

---

## ⚡ Quick Start

```bash
# 1. Install via pip
pip install soc-toolkit

# 2. Perform instant Threat Intel Lookup with AI Triage
soc 185.220.101.45

# 3. Launch Interactive Analyst Terminal Shell
soc shell

# 4. Start Enterprise REST API Server
soc server --port 8000

# 5. Launch 3D Cyber Threat Warfare Dashboard
soc web --port 8080
```

---

## 🔥 Features at a Glance

| Feature | Description | Command |
| :--- | :--- | :--- |
| **🤖 Autonomous AI Analyst** | Root Cause Analysis (RCA) & Cyber Kill Chain Attribution | `soc ai <ioc>` |
| **🔄 Automated SOAR Engine** | Executes containment, host isolation & firewall bans | `soc soar <ioc>` |
| **📜 Compliance Audit** | Maps findings to **PCI-DSS 4.0**, **ISO 27001**, **SOC 2** & **NIST CSF** | `soc audit <ioc>` |
| **⚡ Production REST API** | Multi-tenant JSON REST API backend with key auth & CORS | `soc server --port 8000` |
| **📡 STIX / TAXII 2.1** | TAXII 2.1 feed server for Palo Alto, Fortinet & EDRs | `soc taxii-server` |
| **📦 PCAP Forensics** | Native network packet capture parser & IOC extractor | `soc pcap capture.pcap` |
| **🔬 Static PE Malware Analysis**| ImpHash calculator, section entropy & suspicious API detection | `soc analyze sample.exe` |
| **🔓 Payload Decoder** | Defang/Refang URLs & Base64 PowerShell command decoder | `soc decode "<cmd>"` |
| **🕸️ 3D Threat Dashboard** | High-tech WebGL cyber warfare threat map | `soc web --port 8080` |

---

## 🤖 Autonomous AI Security Analyst

Run instant AI triage on any IP, Domain, Hash, or URL:

```bash
soc ai 185.220.101.45
```

```json
{
  "ioc": "185.220.101.45",
  "threat_level": "CRITICAL",
  "cyber_kill_chain_phase": "Command and Control (C2) / Exfiltration",
  "root_cause_analysis": "Autonomous AI Analysis concluded an overall risk score of CRITICAL. Attribution indicates active alignment with Cyber Kill Chain phase: 'Command and Control (C2)'. Network containment recommended.",
  "ciso_executive_summary": "EXECUTIVE SUMMARY: Indicator 185.220.101.45 poses a CRITICAL risk to enterprise operations. Authorize automated SOAR containment."
}
```

---

## 📜 Regulatory Compliance Frameworks Supported

| Framework | Controls Mapped | Command |
| :--- | :--- | :--- |
| **PCI-DSS 4.0** | Req 6.4 (App Security), Req 10.4 (Audit Telemetry), Req 11.4 (Threat Defense) | `soc audit <ioc>` |
| **ISO/IEC 27001:2022** | Control A.8.7 (Malware Defense), A.8.16 (Monitoring), A.8.23 (Web Filtering) | `soc audit <ioc>` |
| **SOC 2 Type II** | CC6.1 (Access Controls), CC6.8 (Threat Detection), CC7.2 (Incident Response) | `soc audit <ioc>` |
| **NIST CSF 2.0** | DE.CM-01 (Continuous Monitoring), RS.AN-01 (Incident Analysis) | `soc audit <ioc>` |

---

## 🐳 1-Click Container Deployment

```bash
# Docker Compose 1-Click Launch
docker-compose up -d

# Kubernetes Production Deployment
kubectl apply -f k8s/deployment.yaml
```

---

## 🐍 Python SDK

```python
from soc_toolkit import SOCToolkitSDK, AIThreatAnalyst, SOAREngine, IOCType, ThreatLevel

sdk = SOCToolkitSDK()

# Analyze IOC
report = sdk.analyze("185.220.101.45")

# Autonomous AI Triage
ai_triage = AIThreatAnalyst.analyze_threat("185.220.101.45", IOCType.IP, ThreatLevel.CRITICAL)
print("Kill Chain Phase:", ai_triage["cyber_kill_chain_phase"])
```

---

## 👤 Author & License

- **Author**: Furkan Dinçer ([@frkndncr](https://github.com/frkndncr))
- **License**: [MIT License](LICENSE)
