valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
8336929d76
SigmaHQ/tools
History
Thomas Patzke 8336929d76 XPack Watcher Backend: Improved aggregation capabilities 
* Aggregation with "...count(field)...", "...by field..." and
  combination of both
* Still only count() supported
2018-02-08 22:17:35 +01:00
..
config Added default index configs for usual ELK setups 2017-11-09 10:05:41 +01:00
sigma XPack Watcher Backend: Improved aggregation capabilities 2018-02-08 22:17:35 +01:00
merge_sigma Finalizing PyPI release 2017-12-08 23:50:08 +01:00
README.md Added PyPI README 2017-12-09 22:13:25 +01:00
requirements-devel.txt Intermediate refactoring commit: moving code into package 2017-12-08 21:45:05 +01:00
requirements.txt Intermediate refactoring commit: moving code into package 2017-12-08 21:45:05 +01:00
setup.cfg Intermediate refactoring commit: moving code into package 2017-12-08 21:45:05 +01:00
setup.py New PyPI release 2017-12-14 22:40:31 +01:00
sigmac Skipping dotfiles 2017-12-14 22:39:51 +01:00

README.md

This package contains libraries for processing of Sigma rules and the following command line tools:

  • sigmac: converter between Sigma rules and SIEM queries:
    • Elasticsearch query strings
    • Kibana JSON with searches
    • Splunk SPL queries
    • Elasticsearch X-Pack Watcher
    • Logpoint queries
  • merge_sigma: Merge Sigma collections into simple Sigma rules.