8000 Translation of Sigma rule to JSON · wagga40 Zircolite · Discussion #50 · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Translation of Sigma rule to JSON #50

Answered by wagga40
JOAQUINPUERTO asked this question in Q&A
Translation of Sigma rule to JSON #50
@JOAQUINPUERTO JOAQUINPUERTO
Jan 25, 2023 · 1 comment
Answered by wagga40 Return to top
Discussion options

JOAQUINPUERTO
Jan 25, 2023

You must be logged in to vote
Answered by wagga40 Jan 25, 2023

Hi,

sorry for the delay.

The related docs are there : https://github.com/wagga40/Zircolite/blob/master/docs/Usage.md#generate-your-own-rulesets

In short :

  • I strongly recommand to use the repo version of sigma :
git clone https://github.com/SigmaHQ/sigma.git
cd sigma
  • Install related dependencies (check Sigma repo) and for example, if your logs are sysmon logs, you can convert your rules to Zircolite (SQLite in fact) format with :
tools/sigmac \
	-t sqlite \
	-c tools/config/generic/sysmon.yml \
	-c tools/config/generic/powershell.yml \
	-c tools/config/zircolite.yml \
	-d rules/windows/ \
   --output-fields title,id,description,author,tags,level,falsepositives,filename,status \
   --o…
View full answer

Replies: 1 comment

Comment options

wagga40
Jan 25, 2023
Maintainer

You must be logged in to vote
0 replies
Answer selected by wagga40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
Q&A
Labels
None yet
2 participants
@JOAQUINPUERTO @wagga40
0