TheresAFewConors/Sooty

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1488 stars · 223 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Sooty is a Python CLI tool that automates routine tasks for SOC (Security Operations Center) analysts, such as URL sanitization, DNS and WhoIs lookups, IP reputation checks, and email header analysis. It consolidates many common triage checks into one tool to speed up analyst workflows.

Use cases

• check IP reputation against VirusTotal and AbuseIPDB
• decode Proofpoint and Office SafeLink URLs
• analyze phishing emails for URLs and headers
• perform reverse DNS and WhoIs lookups
• check if an IP is a TOR exit node
• check email breaches on HaveIBeenPwned
• sanitize URLs before sharing in emails
• get file hashes and compare against VirusTotal

When to choose

• you are a SOC analyst doing repetitive triage tasks daily
• you want one CLI tool combining reputation checks, URL decoding, and email analysis
• you need quick DNS, WhoIs, and breach lookups from the terminal

When to avoid

• you need a full SOAR platform with case management and orchestration
• you want a GUI-based threat intelligence tool
• you need enterprise-scale automated incident response pipelines

Facets

cli-tool · maturity active

security workflow-automation developer-tools cli security developer-tools python cli cross-platform soc-analyst threat-intelligence phishing-analysis reputation-check url-decoder incident-response dfir automation docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="TheresAFewConors/Sooty")