{"id":24748367,"url":"https://github.com/0xthiebaut/sigmai","last_synced_at":"2025-10-10T17:31:10.768Z","repository":{"id":57620176,"uuid":"259430981","full_name":"0xThiebaut/sigmai","owner":"0xThiebaut","description":"Import specific data sources into the Sigma generic and open signature format.","archived":false,"fork":false,"pushed_at":"2022-05-06T10:44:23.000Z","size":50,"stargazers_count":77,"open_issues_count":0,"forks_count":5,"subscribers_count":10,"default_branch":"master","last_synced_at":"2025-01-28T05:41:56.609Z","etag":null,"topics":["ids","logging","misp","monitoring","security","siem","sigma","signatures"],"latest_commit_sha":null,"homepage":"https://thiebaut.dev/articles/automated-sigma-rule-generation-from-misp-threat-intelligence/","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"eupl-1.2","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xThiebaut.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-04-27T19:26:35.000Z","updated_at":"2024-07-16T22:31:08.000Z","dependencies_parsed_at":"2022-09-17T01:12:53.318Z","dependency_job_id":null,"html_url":"https://github.com/0xThiebaut/sigmai","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xThiebaut%2Fsigmai","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xThiebaut%2Fsigmai/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xThiebaut%2Fsigmai/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xThiebaut%2Fsigmai/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xThiebaut","download_url":"https://codeload.github.com/0xThiebaut/sigmai/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":235970068,"owners_count":19074330,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ids","logging","misp","monitoring","security","siem","sigma","signatures"],"created_at":"2025-01-28T05:45:02.316Z","updated_at":"2025-10-10T17:31:05.456Z","avatar_url":"https://github.com/0xThiebaut.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Sigma Importer\nSigma Importer (a.k.a. `sigmai`) is a project designed to do the opposite of [Sigma](https://github.com/Neo23x0/sigma).\nThe objective of `sigmai` is to convert specific data sources into the Sigma generic and open signature format.\n\n## Installation\nIf you have [Go](https://golang.org/) installed, you can get the newest version of `sigmai` through:\n\n```bash\ngo get github.com/0xThiebaut/sigmai\n```\n\nAlternatively, you can download the [release binaries](https://github.com/0xThiebaut/sigmai/releases) which are updated less frequently.\n\n## Usage\nFor the generic usage's help section, `sigmai` is equipped with the `--help` flag (shorthand `-h`).\n\n```bash\nsigmai --help\n```\n\n\u003e ```\n\u003e Usage of ./sigmai:\n\u003e       --directory-path string       Directory: Path to save rules\n\u003e   -h, --help                        Display this help section\n\u003e   -i, --interval string             Continuous importing interval\n\u003e       --json                        Output JSON instead of pretty print\n\u003e       --level-set string            Set level on all rules [low, medium, high, critical]\n\u003e       --misp-buffer int             MISP: Size of the event buffer (default 500)\n\u003e       --misp-events ints            MISP: Only events with matching IDs\n\u003e       --misp-ids-exclude            MISP: Only IDS-disabled attributes\n\u003e       --misp-ids-ignore             MISP: All attributes regardless of their IDS flag\n\u003e       --misp-insecure               MISP: Allow insecure connections when using SSL\n\u003e       --misp-key string             MISP: User API key\n\u003e       --misp-keywords stringArray   MISP: All events containing any of the keywords\n\u003e       --misp-levels stringArray     MISP: Only events with matching threat levels [1-4]\n\u003e       --misp-period strings         MISP: Only events within time-frame (4d, 3w, ...)\n\u003e       --misp-published              MISP: Only published events\n\u003e       --misp-published-exclude      MISP: Only unpublished events\n\u003e       --misp-tags stringArray       MISP: Only events with matching tags\n\u003e       --misp-url string             MISP: Instance API base URL\n\u003e       --misp-warning-include        MISP: Include attributes listed on warning-list\n\u003e       --misp-workers int            MISP: Number of concurrent workers (default 20)\n\u003e   -q, --quiet                       Only output error information\n\u003e   -s, --source string               Source backend [misp]\n\u003e       --status-set string           Set status on all rules [experimental, testing, stable]\n\u003e       --tags-add stringArray        Add tags on all rules\n\u003e       --tags-clear                  Clear tags from all rules\n\u003e       --tags-rm stringArray         Remove tags from all rules\n\u003e       --tags-set stringArray        Set tags on all rules\n\u003e   -t, --target string               Target backend [stdout, directory] (default \"stdout\")\n\u003e   -v, --verbose                     Show debug information\n\u003e ```\n\n### Sources\nA source is the origin from which data will be fetched in order to generate Sigma rules.\nCurrently, [MISP](https://github.com/MISP/MISP) is the only implemented source.\n\nA source can be defined through the `--source` flag (shorthand `-s`).\nCurrently, the only acceptable value for this flag is `misp`.\n\n#### MISP\nImporting events from MISP can be done by specifying `misp` as source.\nWhen using MISP, The following flags are required:\n\n| Flag            | Description                                                                       |\n|-----------------|-----------------------------------------------------------------------------------|\n| `--misp-url`    | The URL at which the MISP instance API can be queried (i.e. `https://localhost`). |\n| `--misp-key`    | A User API key authorized to query the MISP instance.                             |\n\n##### Use Cases\nA sample `sigmai` command would be as follows:\n\n```bash\nsigmai -t stdout -s misp --misp-url https://localhost --misp-key CAFEBABE== --misp-levels 1,2\n```\n\nThe above command sends the Sigma rules to the `stdout` target (`-t`; more on that later).\nThe Sigma rules are to be generated from the `misp` source (`-s`).\nIn MISP, we'll solely generate Sigma rules for event's with a level (`--misp-levels`) of high (`1`) or medium (`2`).\nFor the eligible events, only attributes flagged for IDS (decent enough for detection) will be used.\nFurthermore, any attribute on a [warning list](https://github.com/MISP/misp-warninglists) (a.k.a. subject to false positives) won't be included.\n\nAs an example, this is how a generated multi-document Sigma rule would look like if imported from MISP:\n\n```yaml\naction: global\ntitle: 'Related IoCs to https://cert.gov.ua/article/39708 - Cyberattack on state organizations\n  of Ukraine using the topic \"Azovstal\" and the malicious program Cobalt Strike Beacon\n  (CERT-UA # 4490)'\nid: 1b2b6e15-3655-4648-afcb-c93214187736\nstatus: experimental\ndescription: See MISP event 6803\nauthor: CIRCL\nlevel: high\ntags:\n  - type:OSINT\n  - osint:lifetime=\"perpetual\"\n  - osint:certainty=\"50\"\n  - tlp:white\n  - misp-galaxy:target-information=\"Ukraine\"\n  - misp-galaxy:tool=\"Cobalt Strike\"\n  - misp-galaxy:tool=\"Trick Bot\"\n---\naction: global\nlogsource:\n  product: windows\n---\ndetection:\n  condition: all of event6803attr2265257mapping*\n  event6803attr2265257mappingHostname:\n    - - DestinationHostname: kitchenbath.mckillican.com\n      - SourceHostname: kitchenbath.mckillican.com\n      - Computer: kitchenbath.mckillican.com\n      - ComputerName: kitchenbath.mckillican.com\n      - Workstation: kitchenbath.mckillican.com\n      - WorkstationName: kitchenbath.mckillican.com\n---\ndetection:\n  condition: all of event6803attr2265258mapping*\n  event6803attr2265258mappingHostname:\n    - - DestinationHostname: www.15ns84-fedex.us\n      - SourceHostname: www.15ns84-fedex.us\n      - Computer: www.15ns84-fedex.us\n      - ComputerName: www.15ns84-fedex.us\n      - Workstation: www.15ns84-fedex.us\n      - WorkstationName: www.15ns84-fedex.us\n---\n// Some more domain-related detections\n---\ndetection:\n  condition: event6803object276948 and all of event6803object276948attr2265319mapping*\n  event6803object276948:\n    - Hashes|contains:\n        - 877f834e8788d05b625ba639b9318512\n        - 96bde83f4d3f29fb2801cd357c1abea827487e37\n        - ea9dae45f81fe3527c62ad7b84b03d19629014b1a0e346b6aa933e52b0929d8a\n        - cf72096dee679bce8cde6eacf922b5559dbac9b77367a7f2a3fba5022fd2b1303aa1c5805167c3cb8fb774e7390fab86eb3d16585fc72c31497a08bdf2b26518\n        - 768:pdzHDjCxD6czZ8K1PjOoDl8SZbKsLRGKpb8rGYrMPelwhKmFV5xtezEs/48/dgAX:pVHDjCxD6czZ8K1PjOoDl8SZbKsLRGKM\n  event6803object276948attr2265319mappingFilename:\n    - - Image|endswith: ea9dae45f81fe3527c62ad7b84b03d19629014b1a0e346b6aa933e52b0929d8a\n      - ProcessName|contains: ea9dae45f81fe3527c62ad7b84b03d19629014b1a0e346b6aa933e52b0929d8a\n---\n// Some more file-related detections\n---\ndetection:\n  condition: event6803\n  event6803:\n    - DestinationIp:\n        - 84.32.188.29\n        - 139.60.161.225\n        - 139.60.161.74\n        - 139.60.161.62\n        - 139.60.161.99\n        - 139.60.161.57\n        - 139.60.161.75\n        - 139.60.161.24\n        - 139.60.161.89\n        - 139.60.161.209\n        - 139.60.161.85\n        - 139.60.160.51\n        - 139.60.161.226\n        - 139.60.161.216\n        - 139.60.161.163\n        - 139.60.160.8\n        - 139.60.161.32\n        - 139.60.161.45\n        - 139.60.161.60\n        - 139.60.160.17\n    - Hashes|contains:\n        - 6f0ddfe6b68ea68b5e450e30b131137b6f01c60cc8383f3c48bea0c8acb6ef1c\n        - 9990fe0d8aac0b4a6040d5979afd822c2212d9aec2b90e5d10c0b15dee8d61b1\n        - df58100f881e2bfa694e00dd06bdb326b272a51ff9b75114819498a26bf6504c\n        - ea9dae45f81fe3527c62ad7b84b03d19629014b1a0e346b6aa933e52b0929d8a\n---\naction: global\nlogsource:\n  category: proxy\n---\ndetection:\n  condition: all of event6803attr2265246mapping*\n  event6803attr2265246mappingURI:\n    - - c-uri: https://e5qo83-fedex.us/wzlco?VLakox?80934612\n      - cs-referrer: https://e5qo83-fedex.us/wzlco?VLakox?80934612\n      - r-dns: https://e5qo83-fedex.us/wzlco?VLakox?80934612\n---\ndetection:\n  condition: all of event6803attr2265247mapping*\n  event6803attr2265247mappingURI:\n    - - c-uri: http://138.68.229.0/pe.dll\n      - cs-referrer: http://138.68.229.0/pe.dll\n      - r-dns: http://138.68.229.0/pe.dll\n---\n// Some more proxy-related detections\n---\ndetection:\n  condition: event6803\n  event6803:\n    - dst_ip:\n        - 84.32.188.29\n        - 139.60.161.225\n        - 139.60.161.74\n        - 139.60.161.62\n        - 139.60.161.99\n        - 139.60.161.57\n        - 139.60.161.75\n        - 139.60.161.24\n        - 139.60.161.89\n        - 139.60.161.209\n        - 139.60.161.85\n        - 139.60.160.51\n        - 139.60.161.226\n        - 139.60.161.216\n        - 139.60.161.163\n        - 139.60.160.8\n        - 139.60.161.32\n        - 139.60.161.45\n        - 139.60.161.60\n        - 139.60.160.17\n---\naction: global\nlogsource:\n  category: webserver\n---\ndetection:\n  condition: all of event6803attr2265246mapping*\n  event6803attr2265246mappingURI:\n    - - c-uri: https://e5qo83-fedex.us/wzlco?VLakox?80934612\n      - cs-referrer: https://e5qo83-fedex.us/wzlco?VLakox?80934612\n      - r-dns: https://e5qo83-fedex.us/wzlco?VLakox?80934612\n---\n// Many more log-sources (firewall, proxy, webserver, ...) are trimmed for readability...\n```\n\n###### Specific Events\nAlternatively, you might wish to import a specific set of events.\nTo do so, you might use the `--misp-events` flag as follows:\n\n```bash\nsigmai -t stdout -s misp --misp-url https://localhost --misp-key CAFEBABE== --misp-events 123,456,789\n```\n\nThe above command will import the events with IDs `123`, `456` and `789`.\n\n###### Searching Events\nYou can also import events whose description contains one of the specified case-sensitive sub-string.\nTo do so, you would need to use the `--misp-keywords` flag as follows:\n\n```bash\nsigmai -t stdout -s misp --misp-url https://localhost --misp-key CAFEBABE== --misp-keywords emotet,zloader\n```\n\nThe above command will import all events whose description contains either the `emotet` or `zloader` substring.\n\n### Targets\nA target is a way to select where to send the generated Sigma rules.\n\nDefining the target can be done using the `--target` flag (shorthand `-t`).\nCurrently, both `stdout` and `directory` are implemented.\n\n#### Stdout\nThis target outputs the generated Sigma rules to the [standard output](https://en.wikipedia.org/wiki/Stdout).\nIt can be selected by using `stdout` as the `--target` flag's value.\n\nDo note that all other logging is send to the  [standard error](https://en.wikipedia.org/wiki/Standard_streams#Standard_error_(stderr)), which enables you to split logging and generated Sigma rules.\n\n#### Directory\nThis target output's the generated Sigma rules into a directory, which defaults to the current one.\nIt can be selected by using `directory` as the `--target` flag's value.\n\nAdditionally, one may change the path using the `--directory-path` flag.\n\n### Modifiers\nThe `sigmai` tool comes with some additional modifiers to ensure the generated rules meet your existing standard.\n\n#### Tags\nMore specifically, one can modify the imported rule's tags by using the beneath flags.\n\n| Flag            | Description                                                                               |\n|-----------------|-------------------------------------------------------------------------------------------|\n| `--tags-add`    | A flag with a comma-separated list of tags to be added to the current ones.               |\n| `--tags-rm`     | A flag with a comma-separated list of tags to be removed if present in the current ones.  |\n| `--tags-set`    | A flag with a comma-separated list of tags to overwrite the current ones.                 |\n| `--tags-clear`  | A flag clearing all tags, resulting in tag-less rules.                                    |\n\n#### Level\nYou can also override the rules by defining a common level using the `--level-set` flag.\n\n#### Status\nAs for levels, `sigmai` enables you to override the status of all rules by using the `--status-set` flag.\n\n### Continuous Importing\nIt is possible to run `sigmai` continuously a bit like a cron job would.\nThe `--interval` flag (shorthand `-i`) defines an interval at which an import should be done.\n\nThis flag can be combined with source's period-filters such as MISP's `--misp-period` flag.\nAs an example, the beneath command will import the last 15 minutes of MISP events as Sigma rules every 10 minutes.\n\n```bash\nsigmai -t directory --directory-path ~/rules -i 10m -s misp --misp-url https://localhost --misp-key CAFEBABE== --misp-period 15m\n``` \n\n## Tips \u0026 Tricks\n\n### Filter Your Queries\nThe `sigmai`-generated queries will hopefully cover more cases (log-sources, platforms, ...) than you actually need.\nDid you know that when compiling the Sigma rules with `sigmac`, you can [filter rules](https://github.com/Neo23x0/sigma#usage) to match your use-cases through the `--filter` flag (shorthand `-f`)?\n\n## Acknowledgements\nDevelopment of this project has been supported by [NVISO Labs](https://www.nviso.eu/en/research). Interested in this project? You might [fit with us](https://www.nviso.eu/en/jobs)!\n\nMany thanks to [Florian Roth](https://twitter.com/Cyb3rOps) for his valuable feedback and without whom we wouldn't have [Sigma](https://github.com/Neo23x0/sigma) in the first place.\n\n## License\n\u0026copy; Maxime Thiebaut, 2020 \u0026mdash; [Licensed under the EUPL](./LICENSE.txt).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xthiebaut%2Fsigmai","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0xthiebaut%2Fsigmai","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xthiebaut%2Fsigmai/lists"}