sigma rule converter. An opensource sigma conversion tool built using pysigma.

Welcome to sigconverter.io, a user-friendly converter for Sigma rules. This project is designed to keep in sync with the pySigma project's backends. Inspired by uncoder.io, it aims to provide an easy-to-use interface for converting Sigma rules.

• sigconverter.io @ GitHub.

Rustinel is an open-source endpoint detection project for Windows and Linux.

It collects native host telemetry using ETW on Windows and eBPF on Linux, normalizes events into a shared model, evaluates Sigma, YARA, and IOC detections, and writes alerts as ECS NDJSON.

Rustinel is designed for blue teams, detection engineers, researchers, and anyone who wants a transparent endpoint detection engine they can inspect, run, test, and extend.

• Rustinel @ GitHub.

SIEM Detection Format. The shareable detection format for security professionals.

Sigma is a generic, open, and structured detection format that allows security teams to detect relevant log events in a simple and shareable way.

Detection engineers, threat hunters and all defensive security practitioners collaborate on detection rules. The repository offers more than 3000 detection rules of different type and aims to make reliable detections accessible to all at no cost.

• Sigma @ GitHub.
• C'est la fin des antivirus @ Underscore_'s Spotify :fr:.
• 🚨 Découvrez Sigma: l'outil open-source qui révolutionne la détection de menaces ! 🚨 @ Maory SChroder's LinkedIn :fr:.

Turn ideas into detections your SIEM understands. Generate Sigma, KQL, and SPL rules with tests and playbooks in seconds.

DetectPack Forge turns plain-English behaviors or sample logs into production-ready detection packs — Sigma, KQL (Sentinel), SPL (Splunk) — plus tests and a response playbook, mapped to MITRE ATT&CK, fully powered by Gen AI.

• DetectPack Forge @ GitHub.

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Mapping of open-source detection rules and atomic tests.

The goal of this project is to bridge the gap between Atomic Red Team's adversary simulations and open-source detection rules. By doing so, this project aims to help security professionals simulate attacks and evaluate their detection strategies more effectively. 🔒

• AttackRuleMap @ GitHub.

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs.

• Comment effectuer une investigation numérique sur les journaux d’évènements Windows avec Zircolite ? @ IT-Connect :fr:.