Zircolite
Open source security data lake for AWS with real-time log normalization and Detection-as-Code capabilities.
Zircolite: A Standalone Tool for SIGMA Rules
Zircolite is a standalone tool developed in Python 3. It enables users to apply SIGMA rules across various log formats, including MS Windows EVTX, Auditd, Sysmon for Linux, EVTXtract, CSV, and XML.
It operates quickly, utilizing a Sigma backend
It operates quickly, utilizing a Sigma backend (SQLite), and has the capability to export results in various formats such as JSON, CSV, Splunk, Elastic, Zinc, and Timesketch. Zircolite can be utilized directly within Python or via the binaries that are provided.
