cisagov/RedEye

Health v2 · maintenance only

Flags: archived

Adoption not part of the score

2767 stars · 291 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

RedEye is an open-source visual analytic tool from CISA and PNNL for visualizing and reporting Red Team command-and-control activities. It parses C2 logs such as Cobalt Strike logs and presents them in an interactive web UI with tagging, comments, and presentation mode.

Use cases

• visualize cobalt strike c2 logs from a red team engagement
• replay and demonstrate red team assessment activities to stakeholders
• analyze attack paths and compromised hosts from a penetration test
• review red team campaign exports in a read-only blue team mode
• tag and annotate command and control activity for reporting
• present red team findings without manually reading thousands of log lines

When to choose

• you need to visualize and report on Cobalt Strike or similar C2 logs after a red team assessment
• you want a dedicated tool to replay attack timelines for blue team or stakeholder briefings
• you need to analyze attack paths and compromised hosts from penetration test logs

When to avoid

• you need actively developed software with new features, since the repo is in maintenance mode
• you need a general-purpose SIEM or log aggregation platform rather than C2 log analysis
• your C2 framework logs are not supported by RedEye's parsers

Facets

application · maturity maintenance

data-visualization parser security security penetration-testing cross-platform cli red-team blue-team c2-logs cobalt-strike penetration-testing log-analysis cybersecurity visualization web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="cisagov/RedEye")