chapinb.com

What It Is

chapinb.com is Chapin Bryce’s personal security engineering and DFIR resource site, bringing together open-source projects, forensic handbooks, honeypot solutions, and two Python forensics-related books. Rather than presenting itself as a traditional commercial security vendor, it serves as an entry point to tools and knowledge resources for security engineers and incident responders.

Core Capabilities

The most notable project is Luminaut. It focuses on cloud exposure assessment: starting from public IPs associated with AWS and GCP resources, it gathers context on related instances, load balancers, security groups, and relevant events. It also combines active scanning via nmap and whatweb with passive sources such as Shodan, giving investigators useful context during the early stages of an investigation. Python Forensics Handbook provides reusable Python code snippets for common DFIR tasks involving the registry, Windows Event Logs, JSON, SQLite, forensic images, and more. The site also includes a collection of secure development resources and RDP Snitch Honeypot, which can capture RDP traffic and aggregate and share observations.

Pricing and Deployment

The site indicates that most resources are free to use or contribute to via GitHub, PyPI, or the website. The two books are sold in print and ebook formats through Packt Publishing and Amazon, but no specific pricing is listed. Deployment is mainly based on local execution, code reuse, and self-hosted honeypots. There is no visible SaaS console, enterprise licensing, SLA, or managed service offering.

Pros and Cons

Its strengths are its focused technical direction, especially for initial cloud exposure triage and scripted DFIR analysis. The tools combine cloud configuration data, scanners, and external intelligence sources, making the investigative workflow practical. The handbook uses short code snippets, which makes them easy to copy and adapt quickly. The limitations are also clear: there is no information on compliance certifications, centralized management, permission auditing, closed-loop alerting, or commercial support. It is not a replacement for full enterprise security platforms such as CNAPP, SIEM, or EDR.

Who It’s For and Access from China

It is best suited to DFIR practitioners, security engineers, researchers, and small response teams with a foundation in Python and cloud security, particularly for investigation support, training, and prototype development. It is not a good fit for organizations that only need an out-of-the-box enterprise platform. The site does not provide information on access from China. Related services such as GitHub, PyPI, Amazon, and Shodan may be affected by local network conditions, and payment methods are not disclosed. Alternative or complementary tools include Prowler, ScoutSuite, CloudQuery, Steampipe, Wazuh, Velociraptor, and commercial CNAPP products.