Trisul Network Analytics https://www.trisul.org offers a scriptable platform upon which you can build your own network and security analysis tools.
There are two APIs available.
Lua scripts are used to customize the Trisul Real Time analytics engine.
The LUA API is documented at https://www.trisul.org/docs/lua
Trisul Remote Protocol use scripts in Ruby, Javascript, or Python to query and hunt through historical data.
The TRP API is documented at https://www.trisul.org/docs/trp