depalmar / ai-dfir-toolkit
A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chains, AI infrastructure, AI-powered insider threats, and RAG/vector database attacks.
Why this job: topics: ai-security, llm-security
What it does
A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chains, AI infrastructure, AI-powered insider threats, and RAG/vector database attacks.
Get started
No single install command. Read the steps in the README (opens in new tab)
- Maintenance
- Active
- Last commit 8 days ago
- Stars
- 159
- +18 this week
- Licence
- Apache-2.0
- Allows business use
- Downloads for
- None listed
- No release files
- Latest tag
- artifacts-v1.1.0
- Released 2 months ago
- Built with
- Python
- 92% of the code
Is it looked after?
- Contributors
- 2
- Last 90 days
- Issues
- 4% closed
- 130 still open
- Pull requests
- 72 merged
- 0 waiting
- Releases
- 2
- 2 in the last year
Similar repos
| Repo | Stars | Last commit | Licence | Downloads for |
|---|---|---|---|---|
| beenuar / AiSOC | 6,958 | yesterday | MIT | No downloads |
| Nebulock-Inc / agentic-threat-hunting-framework | 411 | yesterday | MIT | No downloads |
| ninedter / pcap-hunter | 171 | 10 days ago | MIT | No downloads |
More: languages, topics, project record and preview image
Languages
- Python 92%
- YARA 6%
- Shell 2%
- PowerShell 1%
Topics
- ai-security
- detection-engineering
- dfir
- forensics
- incident-response
- llm-security
- mcp
- sigma
- threat-hunting
Project record
- JobAI security
- StatusListed
- Commits186
- Forks27
- Watching0
- Stars in 28 days+135
- CreatedApr 19, 2026
- First seen by usNov 7, 2026
- CheckedNov 10, 2026