threatwire

What it is and what it does

threatwire is a Python library for building network-level threat detection pipelines. It combines three core components: PacketStreamer (live or PCAP packet ingestion with BPF filtering and stream reassembly), SignatureEngine (multi-pattern matching against 1,200+ built-in rules covering DNS C2, HTTP beaconing, SMB exploits, credential theft, and ransomware IOCs), and ThreatEventBus (pub/sub alert routing with deduplication and severity-based handlers). The library decodes protocols (DNS, HTTP, TLS, SMB) into structured objects and outputs alerts in Elastic Common Schema format for SIEM integration.

It solves the problem of reinventing threat detection infrastructure for each project by providing a unified pipeline from raw packets to actionable alerts. You can run it as a live capture daemon on an interface, analyze PCAP files offline, or use individual modules in a custom pipeline. Built-in rules target common attack patterns (slow SYN scans, C2 beaconing, exploit kits), and you can add custom rules as Python dataclasses or JSON files. Ready-made handlers route alerts to files, Slack, Elasticsearch, or Python logging.

Use it for:

• Monitor a production network interface for DNS tunneling, HTTP beaconing, and SMB exploits in real time, routing high-severity alerts to PagerDuty.
• Analyze PCAP files from incident response investigations to detect C2 communication, credential theft, and ransomware IOCs offline.
• Build a custom IDS by combining threatwire's packet stream and signature engine with your own detection logic and alert handlers.
• Ingest network alerts into Elasticsearch via threatwire's ECS-compatible output for correlation with host and application logs.
• Deduplicate volumetric DDoS alerts while ensuring critical lateral-movement detections route immediately to security teams.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

threatwire provides real-time network packet inspection and threat signature matching for building IDS/IPS pipelines in Python, combining packet capture, protocol decoding, and a pluggable signature engine with built-in IOC rules.

Yes, if you need a unified Python-native threat detection pipeline for IDS/IPS use cases. The library eliminates boilerplate (packet capture, protocol parsing, signature matching, alert routing) and provides built-in rules covering common attack patterns. Install friction is minimal (pure Python, no dependencies), and the MIT license is unrestricted. Caveats: it is early-stage (1.0.0, 117 days old, zero GitHub stars), so production readiness and community support are unproven; verify built-in rules match your threat model.

Install

threatwire on PyPI

pip install threatwire

uv add threatwire

poetry add threatwire

Installing threatwire

Before you install

Low friction: pure Python wheel with no runtime dependencies. Active maintenance as of 2026-04-19 with current Python version support (3.9–3.12). Early-stage project (1.0.0, 117 days since release) with zero stars, so community feedback is limited.

License in practice

MIT license is permissive; you can use, modify, and distribute threatwire freely in commercial or proprietary projects with minimal restrictions.

Quickstart

pip install threatwire

from threatwire import ThreatPipeline
from threatwire.core.models import AlertSeverity

pipeline = ThreatPipeline(
    interface="eth0",
    bpf_filter="tcp or udp",
    enable_builtin_rules=True,
)

@pipeline.on_alert(severity="high")
def handle_threat(alert):
    print(f"[{alert.severity.value.upper()}] {alert.rule_name}")

pipeline.run()

Live packet capture requires raw socket permissions (typically root or CAP_NET_RAW on Linux); PCAP file analysis has no special requirements.

Verify before relying

• Whether the 1,200+ built-in rules cover your specific threat landscape and how often they are updated.
• Performance characteristics under high packet volume (throughput, latency, memory footprint).
• Compatibility with existing SIEM/alert infrastructure beyond the documented handlers.
• Whether optional extras (capture, fast) are required for your use case or if core library suffices.

Package facts

Evidence: threatwire-1.0.0-py3-none-any.whl

Keywords: security, ids, ips, network, threat-detection, mitre-attack, cybersecurity

Tags

More Security packages