Sooty is an all-in-one CLI tool designed to automate routine SOC analyst workflows by performing threat hunting, incident response, and security automation tasks efficiently.
The SOC Analysts all-in-one CLI tool to automate and speed up workflow.
SOC analysts use Sooty to automate repetitive security operations tasks such as reputation checks, URL sanitization, and email analysis, enabling faster incident response and deeper threat hunting. It streamlines the workflow by integrating multiple threat intelligence sources and enrichment techniques into a single command-line interface.
API keys are required for full functionality with VirusTotal, HaveIBeenPwned, and PhishTank integrations. Users should be aware of rate limits, such as the 10 requests per hour limit on URL unshortening. The tool is designed primarily for SOC analysts and assumes familiarity with command-line operations and security workflows.
Ensure Python is installed
Clone the repository from https://github.com/theresafewconors/sooty
Install required dependencies (details not explicitly provided but implied Python packages)
Configure API keys for VirusTotal, HaveIBeenPwned, and PhishTank as required
Run the tool via the command linesooty sanitize-url <url>
Sanitizes URLs to make them safe for sending in emails
sooty dns-lookup <ip_or_domain>
Performs reverse DNS and DNS lookups
sooty reputation-check <ip_or_hash>
Checks reputation using VirusTotal, BadIPs, and AbuseIPDB
sooty decode <encoded_string>
Decodes Proofpoint URLs, UTF-8, Office SafeLink URLs, Base64 strings, and Cisco7 passwords
sooty whois <ip_or_domain>
Performs Whois lookups
sooty hibp-check <email_or_username>
Checks if an email or username has been breached using HaveIBeenPwned
sooty unshorten-url <shortened_url>
Unshortens URLs shortened by external services (limited to 10 requests per hour)
sooty urlscan <url>
Queries URLScan.io for reputation reports
sooty phishtank-submit <url>
Submits URLs to PhishTank for phishing verification
sooty create-email-template <email_file.msg>
Creates dynamic email templates for phishing triage response