RedSEC v1.1.0

RedSEC v1.1.0

New: Full SEC correlation rule type support

Inspired by feedback from Risto Vaarandi (creator of SEC), this release
adds complete support for all major SEC correlation rule types.

New rule types

PairWithWindow — monitors for event A followed by event B within a
configurable time window. Fires action on match, action2 on timeout.

Context — captures a field value (target, tool, or port) from a trigger
event, then checks if the next matching event shares the same value.
Useful for detecting focused vs. scattered attacks.

Synthetic — counts trigger events within a sliding window. When threshold
is reached, the engine generates a synthetic RedSecEvent and groups all
contributing events into an attack chain.

Default rules added

• Recon to Exploit Pair (PairWithWindow, 300s)
• Credential Attack Pair (PairWithWindow, 120s)
• Lateral Movement Pair (PairWithWindow, 600s)
• Same Target Attack (Context, 86400s)
• Same Target Credential Attack (Context, 3600s)
• Mass Port Scan Detected (Synthetic, threshold=3, 300s)
• Brute Force Storm (Synthetic, threshold=5, 120s)

Tests

96 tests passing on Python 3.11 and 3.12.

RedSEC v1.0.0

RedSEC v1.0.0 — Initial Release
Red team log aggregation, correlation, and SEC export tool.
What is RedSEC?
RedSEC collects output from offensive security tools, correlates events into attack chains, maps them to MITRE ATT&CK techniques, scores detection risk, and exports to Risto Vaarandi's SEC (Simple Event Correlator) format.
Features

9 tool parsers — nmap, subfinder, ffuf, feroxbuster, nuclei, sqlmap, hydra, metasploit, impacket
YAML-based attack chain correlation engine with 8 default rules
MITRE ATT&CK mapping for every event (11 techniques across 6 tactics)
Detection risk heuristic scoring (0.0–1.0) per event
SEC export — generates rules.conf consumable directly by Vaarandi's SEC daemon
HTML report — dark-theme timeline with severity badges and MITRE tags
SEC-compatible event log output via --out-log flag
Cross-platform — Windows, Linux, macOS
52 automated tests passing on Python 3.11 and 3.12

Installation
git clone https://github.com/alisalive/RedSEC
cd RedSEC
pip install -e .
Acknowledgements
SEC (Simple Event Correlator) by Risto Vaarandi — the correlation engine that inspired this project's export format. https://github.com/simple-evcorr/sec