Skip to content

Commit

Permalink
Add on the fly Sigma YAML rule conversion with pySigma
Browse files Browse the repository at this point in the history
Add conditional imports to limit error for functions not used
Add option groups to improve help readability
Correct typo in docs
Update some error messages
Bump version to 2.20.0
  • Loading branch information
wagga40 committed Jan 2, 2024
1 parent 3d2a94f commit 7fe72c6
Show file tree
Hide file tree
Showing 6 changed files with 824 additions and 254 deletions.
2 changes: 1 addition & 1 deletion Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
DOCKER?=docker
DOCKER_BUILD_FLAGS?=
DOCKER_REGISTRY?=docker.io
DOCKER_TAG?=2.10
DOCKER_TAG?=2.20.0
GIT?=git
PY3?=python3
DATE=$(shell date +%s)
Expand Down
8 changes: 4 additions & 4 deletions docs/Usage.md
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ git clone https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES.git

### Installation from repository

#### Using [*venv*](https://packaging.python.org/en/latest/guides/installing-using-pip-and-virtual-environments/) on Linux/MacOS
#### Using [venv](https://packaging.python.org/en/latest/guides/installing-using-pip-and-virtual-environments/) on Linux/MacOS

**Requirements** : Python 3 venv

Expand All @@ -45,7 +45,7 @@ python3 zircolite.py -e EVTX-ATTACK-SAMPLES/ -r rules/rules_windows_sysmon_pysig
deactivate # Quit Python3 venv
```

#### Using [*Pdm*](https://pdm-project.org/latest/) or [Poetry](https://python-poetry.org)
#### Using [Pdm](https://pdm-project.org/latest/) or [Poetry](https://python-poetry.org)

```shell
# INSTALL
Expand Down Expand Up @@ -364,14 +364,14 @@ Default rulesets are already provided in the `rules` directory. These rulesets o

### Generate rulesets using PySigma

#### Using [*Pdm*](https://pdm-project.org/latest/) or [Poetry](https://python-poetry.org)
#### Using [Pdm](https://pdm-project.org/latest/) or [Poetry](https://python-poetry.org)

```shell
# INSTALL
git clone https://github.com/SigmaHQ/sigma.git
cd sigma
pdm init -n
pdm add pysigma sigma-cli pysigma-pipeline-sysmon pysigma-pipeline-windows pysigma-backend-sqlite
pdm add pysigma pip sigma-cli pysigma-pipeline-sysmon pysigma-pipeline-windows pysigma-backend-sqlite

# GENERATE RULESET (SYSMON)
pdm run sigma convert -t sqlite -f zircolite -p sysmon -p windows-logsources sigma/rules/windows/ -s -o rules.json
Expand Down
Binary file modified docs/Zircolite_manual.pdf
Binary file not shown.
Binary file added pics/Zircolite.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading

0 comments on commit 7fe72c6

Please sign in to comment.