{"categories":[{"label":"Security","url":"https://skillfed.io/packages/category/security/2"},{"label":"Monitoring","url":"https://skillfed.io/packages/category/system-networking-monitoring"}],"enrichment":{"capability":"threatwire provides real-time network packet inspection and threat signature matching for building IDS/IPS pipelines in Python, combining packet capture, protocol decoding, and a pluggable signature engine with built-in IOC rules.","skillfed_tags":["network-security","threat-detection","ids-ips"],"use_cases":["Monitor a production network interface for DNS tunneling, HTTP beaconing, and SMB exploits in real time, routing high-severity alerts to PagerDuty.","Analyze PCAP files from incident response investigations to detect C2 communication, credential theft, and ransomware IOCs offline.","Build a custom IDS by combining threatwire's packet stream and signature engine with your own detection logic and alert handlers.","Ingest network alerts into Elasticsearch via threatwire's ECS-compatible output for correlation with host and application logs.","Deduplicate volumetric DDoS alerts while ensuring critical lateral-movement detections route immediately to security teams."],"what_it_does":"threatwire is a Python library for building network-level threat detection pipelines. It combines three core components: PacketStreamer (live or PCAP packet ingestion with BPF filtering and stream reassembly), SignatureEngine (multi-pattern matching against 1,200+ built-in rules covering DNS C2, HTTP beaconing, SMB exploits, credential theft, and ransomware IOCs), and ThreatEventBus (pub/sub alert routing with deduplication and severity-based handlers). The library decodes protocols (DNS, HTTP, TLS, SMB) into structured objects and outputs alerts in Elastic Common Schema format for SIEM integration.\n\nIt solves the problem of reinventing threat detection infrastructure for each project by providing a unified pipeline from raw packets to actionable alerts. You can run it as a live capture daemon on an interface, analyze PCAP files offline, or use individual modules in a custom pipeline. Built-in rules target common attack patterns (slow SYN scans, C2 beaconing, exploit kits), and you can add custom rules as Python dataclasses or JSON files. Ready-made handlers route alerts to files, Slack, Elasticsearch, or Python logging.","worth_installing":"Yes, if you need a unified Python-native threat detection pipeline for IDS/IPS use cases. The library eliminates boilerplate (packet capture, protocol parsing, signature matching, alert routing) and provides built-in rules covering common attack patterns. Install friction is minimal (pure Python, no dependencies), and the MIT license is unrestricted. Caveats: it is early-stage (1.0.0, 117 days old, zero GitHub stars), so production readiness and community support are unproven; verify built-in rules match your threat model."},"id":"threatwire","links":{"html":"https://skillfed.io/packages/threatwire","md":"https://skillfed.io/packages/threatwire.md","pypi":"https://pypi.org/project/threatwire/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-04-19","license_spdx":null,"license_treatment":"permissive","name":"threatwire","python_support":"supports_current","summary":"Real-time network packet inspection and threat signature matching for Python-based IDS/IPS pipelines"},"popularity":{"monthly_downloads":271863,"position":8217,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"1.0.0"}