Toolsmith -

AI-Powered Knowledge Graph Generator & APTs

toolsmith #153: unstructured text to interactive knowledge graph via LLM & SPO triplet extraction

Posted on February 10, 2026 | 7 minutes | Russ McRee, Ph.D.

Courtesy of TLDR InfoSec Launches & Tools again, another fine discovery in Robert McDermott’s AI Powered Knowledge Graph Generator. Robert’s system takes unstructured text, uses your preferred LLM and extracts knowledge in the form of Subject-Predicate-Object (SPO) triplets, then visualizes the relationships as an interactive knowledge graph.[1]

[Read More]

AI knowledge graph visualization toolsmith Python data science

OctoSQL & Vulnerability Data

toolsmith #152: CLI SQL to query and join disparate databases and file formats

Posted on June 5, 2025 | 5 minutes | Russ McRee, Ph.D.

As an avid daily reader of TLDR Information Security I benefit twofold. First, I gain interesting insights and recommendations regarding launches and tools, where I first learned about OctoSQL. Second, concerning vulnerability details inevitably land in my inbox on a near daily basis. Aside from my recommendation to join the TLDR InfoSec mailing list, toolsmith readers also benefit twofold as, herein, I share the use of OctoSQL as a fast CLI interface to vulnerability data aggregated via CVE-Vulnerability-Information-Downloader. If ever you’ve wanted to join vulnerability data (CVE, CVSS, EPSS, etc) from disparate data sources and file types, this is the toolsmith for you.

[Read More]

SQL OctoSQL CVE EPSS toolsmith CVSS KEV vulnerabilities

toolsmith snapshot: Protect AI ModelScan

Protection Against Model Serialization Attacks

Posted on February 16, 2025 | 5 minutes | Russ McRee, Ph.D.

Protect AI’s OSS portfolio includes tools aimed at improving security of AI/ML software. These tools are meant for a wide range of engineering, security and ML practitioners including developers, security engineers/researchers, ML engineers, LLM engineers and prompt engineers, and data scientists.
Of particular interest in light of model serialization attacks is ModelScan.

[Read More]

AI ModelScan Tensorflow serialization toolsmith Python data science

Sandfly Security

toolsmith #151: Agentless Linux security with unmatched speed and reliability

Posted on June 28, 2023 | 5 minutes | Russ McRee, Ph.D.

Sandfly Security, headquartered in New Zealand (where they know sandflies all to well), refers to itself as such because they’re like sandflies: they relentlessly bug and discourage intruders, deploying like a swarm onto endpoints, then disappear only to return again and again. Theses swarms of checks make life miserable for hackers on Linux hosts while minimizing system impact. I’ve been following Sandfly’s Craig Rowland on Twitter for awhile with the intent of giving Sandlfy a look for toolsmith, and in the time I’ve kept watch, the offering has grown into a comprehensive and robust platform for Linux security.

[Read More]

blue team sandfly linux agentless toolsmith visualization

EDA with CISSM

toolsmith #150: Exploratory Data Analysis with University of Maryland's Center for International and Security Studies Cyber Attacks Database

Posted on May 4, 2023 | 12 minutes | Russ McRee, Ph.D.

Introduction

Exploratory data analysis (EDA) is a mission critical task underpinning the predominance of detection development and preparation for cybersecurity-centric machine learning. There are a number of actions that analysts can take to better understand a particular data set and ready it for more robust utilization. In the spirit of toolsmith, and celebration of this being the 150th issue since toolsmith’s inception in late 2006, consider what follows a collection of tools for your security data analytics tool kit.

[Read More]

blue team data science ggplot2 R toolsmith visualization

HolisticInfoSec

Russ McRee

Posted on January 1, 0001 | 5 minutes | Russ McRee, Ph.D.

Russ McRee writes award-winning toolsmith, published ~~monthly~~ as often as possible. ;-)

As of August 2018, toolsmith is exclusively published via holisticinfosec.io.
From September 2015 through August 2018, toolsmith was exclusively published at the HolisticInfoSec blog.
From November 2006 through August 2015, toolsmith was published in the ISSA Journal.

Thank you for your continued patronage and support.

toolsmith