sigma_attack

sigma_attack is a project designed to load, validate and process Sigma rules for attack pattern detection in different environments.

We load and parse yaml files, validate against json schema, show tag distribution statistics. We collect required fields and analyse attack patterns.

License

Apache-2.0 license

Features

• Parse Sigma rule YAML files
• Validate files against a specified JSON schema
• Accumulate and save tag distribution statistics
• Filter files based on author reputation (in progress)
• Analyse attack patterns

Installation

git clone project, poetry install

Contributions

We welcome contributions. Please fork the repository, create a new branch and commit and push your changes and create PR as usual.