Update docs and rulesets

wagga40 · Aug 17, 2023 · dda4834 · dda4834
1 parent 08e2cfd
commit dda4834
Show file tree

Hide file tree

Showing 13 changed files with 152,584 additions and 148,587 deletions.
diff --git a/README.md b/README.md
@@ -50,6 +50,14 @@ python3 zircolite.py --events <JSON_FOLDER or JSON_FILE> --ruleset rules/rules_w
 
 :information_source: If you want to try the tool you can test with [EVTX-ATTACK-SAMPLES](https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES) (EVTX Files).
 
+#### Updating default rulesets
+
+```shell
+python3 zircolite.py -U
+```
+
+:information_source: Please note these rulesets are provided to use Zircolite out-of-the-box but [you should generate your own rulesets](#why-you-should-build-your-own-rulesets) but they can be very noisy or slow. These auto-updated rulesets are available on the dedicated repository : [Zircolite-Rules](https://github.com/wagga40/Zircolite-Rules).
+
 ## Docs
 
 Everything is [here](docs).

diff --git a/docs/Advanced.md b/docs/Advanced.md
@@ -43,7 +43,7 @@ Except when `evtx_dump` is used, Zircolite only use one core. So if you have a l
 
 	```shell
 	find <CASE_DIRECTORY> -maxdepth 1 -mindepth 1 -type d | \
-		parallel --bar python3 zircolite.py --evtx {} 
+		parallel --bar python3 zircolite.py --evtx {} \ 
 		--ruleset rules/rules_windows_sysmon.json --outfile {/.}.json
 	```
 

diff --git a/docs/README.md b/docs/README.md
@@ -1,5 +1,7 @@
 # Zircolite documentation
 
+**Dedicated documentation website is available [here](https://wagga40.github.io/Zircolite)**
+
 ## Usage
 
 * [Requirements and Installation](Usage.md#requirements-and-installation)

diff --git a/docs/Zircolite_manual.pdf b/docs/Zircolite_manual.pdf
diff --git a/rules/rules_linux.json b/rules/rules_linux.json
diff --git a/rules/rules_windows_generic.json b/rules/rules_windows_generic.json
diff --git a/rules/rules_windows_generic_full.json b/rules/rules_windows_generic_full.json
diff --git a/rules/rules_windows_generic_high.json b/rules/rules_windows_generic_high.json
diff --git a/rules/rules_windows_generic_medium.json b/rules/rules_windows_generic_medium.json
diff --git a/rules/rules_windows_sysmon.json b/rules/rules_windows_sysmon.json
diff --git a/rules/rules_windows_sysmon_full.json b/rules/rules_windows_sysmon_full.json
diff --git a/rules/rules_windows_sysmon_high.json b/rules/rules_windows_sysmon_high.json
diff --git a/rules/rules_windows_sysmon_medium.json b/rules/rules_windows_sysmon_medium.json