Trisul Network Analytics https://www.trisul.org offers a scriptable platform upon which you can build your own network and security analysis tools.
There are two APIs available.
The JA3 TLS Fingerprints database has now moved to a new repository ja3prints
Lua scripts are used to customize the Trisul Real Time analytics engine.
The LUA API is documented at https://www.trisul.org/docs/lua
Trisul Remote Protocol use scripts in Ruby, Javascript, or Python to query and hunt through historical data.
The TRP API is documented at https://www.trisul.org/docs/trp