Charles Timmons Tools 03
Tools
Small, open-source security utilities. Each one is practical on day one, documented, and free to use.
Projects 01—∞
01 Blue teamioc-enrich
Paste in an indicator — IP, domain, URL, hash, or email — and get a clean, copy-pasteable OSINT table for a SOC report. The core sources need no API keys, so there's nothing to sign up for before it's useful.
02 Blue teamheadercheck
Paste raw email headers and get a spoofing read-out: SPF/DKIM/DMARC results, sender and reply-to mismatches, lookalike domains, and the relay-hop timeline. Runs entirely offline — no network, no keys.
03 Blue teampromptmap
Point it at your own LLM app's endpoint and it fires known prompt-injection and jailbreak payloads, then reports which ones got through. Canary and rule checks run with no setup; an optional LLM judge adds nuance. Exits non-zero on a breach, so it drops into CI.
04 Blue teamagent-trace-monitor
Feed it an LLM agent's transcript and it flags suspicious behavior: data exfiltration, secret access, destructive actions, goal drift, and language suggesting the agent is hiding its intent. Rule detectors run with no keys; an optional LLM monitor adds a second opinion.
05 Blue teamlogtriage
Point it at a log file and it extracts indicators, flags notable events, tallies brute-force sources, and builds a timeline — the manual grep-and-correlate pass in one command. Pipes its external indicators straight into ioc-enrich. No keys, no network.
06 Blue teamdetection-linter
Lints Sigma and YARA rules for the mistakes that make them noisy, slow, or broken — undefined selections, over-broad matches, unused strings, catastrophic regex. Static checks need no setup; an optional AI layer explains each rule and suggests evasions to test against.
07 Blue teamleakcheck
Scans a repo you control for leaked secrets and PII — across the working tree, the full git history, and commit messages, where accidentally-committed keys usually survive long after they're deleted. Redacted, severity-ranked output; exits non-zero on a high-risk find for CI.