valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 17:58:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
2f1890b5e8
SigmaHQ/tools
History
Thomas Patzke 30948b9c1a Added sigma-similarity tool 
Fixed also bug in backend base class that was triggered by the way
backends are used by this tool.
2019-10-25 21:59:03 +02:00
..
config create winlogbeat config/taxonomy specific to elastic enabled winlogbeat modules such as the one for sysmon](https://github.com/elastic/beats/blob/master/x-pack/winlogbeat/module/security/config/winlogbeat-security.js) sigmac conversion 2019-10-01 10:16:42 -04:00
sigma Added sigma-similarity tool 2019-10-25 21:59:03 +02:00
tests Sigmatools release 0.12 2019-08-01 23:45:07 +02:00
merge_sigma Fixes for parser split 2018-07-27 00:02:07 +02:00
README.md Sigma tools release 0.11 2019-05-30 22:56:38 +02:00
requirements-devel.txt Added requirements 2018-10-22 22:43:59 +02:00
requirements-misp.txt Added requirements 2018-10-22 22:43:59 +02:00
requirements.txt Intermediate refactoring commit: moving code into package 2017-12-08 21:45:05 +01:00
setup.cfg Intermediate refactoring commit: moving code into package 2017-12-08 21:45:05 +01:00
setup.py Sigmatools release 0.13 2019-10-21 11:58:26 +02:00
sigma2genericsigma Increased indentation to 4 2019-03-02 00:14:20 +01:00
sigma2misp Dropped .py suffix 2018-10-22 23:02:05 +02:00
sigma-similarity Added sigma-similarity tool 2019-10-25 21:59:03 +02:00
sigmac Improved --backend-config help text 2019-10-07 22:30:57 +02:00

README.md

This package contains libraries for processing of Sigma rules and the following command line tools:

  • sigmac: converter between Sigma rules and SIEM queries:
    • Elasticsearch query strings
    • Kibana JSON with searches
    • Splunk SPL queries
    • Elasticsearch X-Pack Watcher
    • Logpoint queries
  • merge_sigma: Merge Sigma collections into simple Sigma rules.
  • sigma2misp: Import Sigma rules to MISP events.