{"id":33171307,"url":"https://github.com/mtnmunuklu/alterix","last_synced_at":"2026-01-12T12:02:06.583Z","repository":{"id":147965823,"uuid":"601466810","full_name":"mtnmunuklu/alterix","owner":"mtnmunuklu","description":"Converts Sigma, Yara rules and IOCs","archived":false,"fork":false,"pushed_at":"2025-01-26T08:15:00.000Z","size":4792,"stargazers_count":17,"open_issues_count":1,"forks_count":3,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-11-20T19:06:54.037Z","etag":null,"topics":["cognitive-siem","crypttech","csiem","demo","docker","go","golang","ioc","sigma","yara"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mtnmunuklu.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":["mtnmunuklu"],"patreon":null,"open_collective":null,"ko_fi":null,"tidelift":null,"community_bridge":null,"liberapay":null,"issuehunt":null,"otechie":null,"custom":null}},"created_at":"2023-02-14T05:54:00.000Z","updated_at":"2025-10-16T09:11:10.000Z","dependencies_parsed_at":null,"dependency_job_id":"7ccd0656-171c-4930-9bc9-e4d9da78fd46","html_url":"https://github.com/mtnmunuklu/alterix","commit_stats":null,"previous_names":[],"tags_count":14,"template":false,"template_full_name":null,"purl":"pkg:github/mtnmunuklu/alterix","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mtnmunuklu%2Falterix","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mtnmunuklu%2Falterix/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mtnmunuklu%2Falterix/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mtnmunuklu%2Falterix/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mtnmunuklu","download_url":"https://codeload.github.com/mtnmunuklu/alterix/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mtnmunuklu%2Falterix/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28338973,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-12T10:58:46.209Z","status":"ssl_error","status_checked_at":"2026-01-12T10:58:42.742Z","response_time":98,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cognitive-siem","crypttech","csiem","demo","docker","go","golang","ioc","sigma","yara"],"created_at":"2025-11-16T01:00:46.865Z","updated_at":"2026-01-12T12:02:06.576Z","avatar_url":"https://github.com/mtnmunuklu.png","language":"Go","funding_links":["https://github.com/sponsors/mtnmunuklu"],"categories":["Tools"],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n  \u003cimg width=\"300\" height=\"300\" src=\"images/logo.png\"\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n\u003ca href=\"https://pkg.go.dev/github.com/mtnmunuklu/alterix\"\u003e\u003cimg src=\"https://img.shields.io/badge/%F0%9F%93%9A%20godoc-pkg-informational.svg\" alt=\"Go Doc\"\u003e\u003c/a\u003e \u003ca href=\"https://goreportcard.com/report/github.com/mtnmunuklu/alterix\"\u003e\u003cimg src=\"https://img.shields.io/badge/%F0%9F%93%9D%20goreport-A+-success.svg\" alt=\"Go Report\"\u003e\u003c/a\u003e \u003ca href=\"https://travis-ci.com/\"\u003e\u003cimg src=\"https://img.shields.io/badge/%E2%9A%99%20build-X-success.svg\" alt=\"Build Status\"\u003e\u003c/a\u003e \n\n# Alterix\n\nAlterix is a tool that converts Sigma, Yara rules, and IOCs (Indicators of Compromise) to the query language of CRYPTTECH's next-generation SIEM product.\n\n## Table of Contents\n\n- [Overview](#overview)\n- [Installation](#installation)\n  - [Normal Installation](#normal-installation)\n  - [Docker Installation](#docker-installation)\n- [Usage](#usage)\n  - [Normal Usage](#normal-usage)\n  - [Docker Usage](#docker-usage)\n- [Demo](#demo)\n- [Contributing](#contributing)\n- [Acknowledgement](#acknowledgement)\n- [License](#license)\n\n## Overview\n\nSigma is an open-source project that provides a rule format and a set of tools for the creation and sharing of detection rules for security operations. Yara is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. IOCs (Indicators of Compromise) are artifacts observed on a network or in an operating system that indicate a security breach. CRYPTTECH's SIEM product uses a proprietary query language for searching through logs and identifying security events. Alterix serves as a bridge between Sigma, Yara, IOCs, and CRYPTTECH's SIEM product, allowing security teams to leverage their existing Sigma and Yara rule sets, as well as IOCs, with the advanced capabilities of CRYPTTECH's SIEM product.\n\n\n## Installation\nTo use Alterix, you have two options for installation:\n### Normal Installation\nAlterix provides precompiled ZIP files for different platforms. You can download the appropriate ZIP file for your platform from the following links:\n\n- [Windows](https://github.com/mtnmunuklu/alterix/releases/latest/download/alterix-windows-latest.zip)\n- [Linux](https://github.com/mtnmunuklu/alterix/releases/latest/download/alterix-ubuntu-latest.zip)\n- [macOS](https://github.com/mtnmunuklu/alterix/releases/latest/download/alterix-macos-latest.zip)\n\nOnce you have downloaded the ZIP file for your platform, extract it to a directory of your choice. The extracted files will include the Alterix executable.\n\nMake sure the directory containing the Alterix executable is added to your system's PATH environment variable, so you can run Alterix from any location in the command line.\n\nPlease note that Alterix requires Go to be installed on your system. You can download and install Go from the official website: [https://golang.org/dl/](https://golang.org/dl/)\n\n### Docker Installation\n\nAlternatively, you can use Docker to run Alterix in a containerized environment. Docker provides a convenient and consistent way to set up and use Alterix without worrying about dependencies or system configurations.\n\nTo install and set up Alterix using Docker, make sure you have Docker installed on your system. If you don't have it, you can download and install Docker from the official website: https://www.docker.com/get-started\n\nOnce Docker is installed, run the provided commands to create a Docker image for Alterix and start the container:\n\n1. **Clone the Repository**: If you haven't done so already, clone the Alterix repository to your local machine:\n\n   ```shell\n   git clone https://github.com/mtnmunuklu/alterix.git\n   ```\n2. **Navigate to Docker Directory**: Go to the docker directory inside the cloned repository:\n\n   ```shell\n   cd tools/docker\n   ```\n3. **Build Docker Image and Start Container**: Use the setup script to build the Docker image named alterix-image:\n\n   ```shell\n   go run setup_docker_alterix.go -rules \u003crulesDirectory\u003e -config \u003cconfigFile\u003e -output \u003coutputDirectory\u003e\n   ```\n   \n   This script will handle the building of the Docker image and starting the container for you.\n\nThat's it! You have successfully installed Alterix on your system. You can now proceed to the [Usage](#usage) section to learn how to use Alterix.\n\nIf you prefer to build Alterix from source, you can refer to the [Build Instructions](BUILD.md) for detailed steps on how to build and install it on your platform.\n\n## Usage\n\nTo use Alterix, you will need Sigma rules, Yara rules, IOCs, and a configuration file for CRYPTTECH's SIEM product. Sigma rules are written in YAML format and can be found in the Sigma GitHub repository: https://github.com/Neo23x0/sigma/tree/master/rules. Yara rules are written in Yara's syntax and can be found in the Yara GitHub repository: https://github.com/VirusTotal/yara. IOCs are typically provided by threat intelligence platforms and can be formatted in various ways.\n\nThe configuration file for CRYPTTECH's SIEM product should be obtained from your system administrator.\n\n### Normal Usage\n\nTo convert Sigma rules to the query language of CRYPTTECH's SIEM product in your local environment, follow these steps:\n\n1. Prepare Sigma rules and a configuration file.\n2. Convert Sigma rules to the query language of CRYPTTECH's SIEM product by running the following command:\n\n    ```shell\n    ./alterix -sigma -filepath \u003cpath-to-sigma-rules\u003e -config \u003cpath-to-config\u003e [-json] [-output \u003coutput-directory\u003e]\n    ```\n    or\n    ```shell\n    ./alterix -sigma -filecontent \u003ccontent-to-sigma-rules\u003e -configcontent \u003ccontent-to-config\u003e [-json] [-output \u003coutput-directory\u003e]\n    ```\n\nTo convert Yara rules to the query language of CRYPTTECH's SIEM product, follow these steps:\n\n1. Prepare Yara rules and a configuration file.\n2. Convert Yara rules to the query language of CRYPTTECH's SIEM product by running the following command:\n\n    ```shell\n    ./alterix -yara -filepath \u003cpath-to-yara-rules\u003e -config \u003cpath-to-config\u003e [-json] [-output \u003coutput-directory\u003e]\n    ```\n    or\n    ```shell\n    ./alterix -yara -filecontent \u003ccontent-to-yara-rules\u003e -configcontent \u003ccontent-to-config\u003e [-json] [-output \u003coutput-directory\u003e]\n    ```\n\nTo convert IOCs to the query language of CRYPTTECH's SIEM product, follow these steps:\n\n1. Prepare IOCs and a configuration file.\n2. Convert IOCs to the query language of CRYPTTECH's SIEM product by running the following command:\n\n    ```shell\n    ./alterix -ioc -filepath \u003cpath-to-iocs\u003e -config \u003cpath-to-config\u003e [-json] [-output \u003coutput-directory\u003e]\n    ```\n    or\n    ```shell\n    ./alterix -ioc -filecontent \u003ccontent-to-iocs\u003e -configcontent \u003ccontent-to-config\u003e [-json] [-output \u003coutput-directory\u003e]\n    ```\n\n### Docker Usage\n\nIf you have installed Alterix using Docker, you can use the following command to run Alterix inside the Docker container:\n\n```shell\ndocker exec alterix ./alterix -sigma -filepath \u003cpath-to-sigma-rules\u003e -config \u003cpath-to-config\u003e [-json] [-output \u003coutput-directory\u003e]\n```\nor\n```shell\ndocker exec alterix ./alterix -sigma -filecontent \u003ccontent-to-sigma-rules\u003e -configcontent \u003ccontent-to-config\u003e [-json] [-output \u003coutput-directory\u003e]\n```\n\nFor Yara rules:\n```shell\ndocker exec alterix ./alterix -yara -filepath \u003cpath-to-yara-rules\u003e -config \u003cpath-to-config\u003e [-json] [-output \u003coutput-directory\u003e]\n```\nor\n```shell\ndocker exec alterix ./alterix -yara -filecontent \u003ccontent-to-yara-rules\u003e -configcontent \u003ccontent-to-config\u003e [-json] [-output \u003coutput-directory\u003e]\n```\n\nFor IOCs:\n```shell\ndocker exec alterix ./alterix -ioc -filepath \u003cpath-to-iocs\u003e -config \u003cpath-to-config\u003e [-json] [-output \u003coutput-directory\u003e]\n```\nor\n```shell\ndocker exec alterix ./alterix -ioc -filecontent \u003ccontent-to-iocs\u003e -configcontent \u003ccontent-to-config\u003e [-json] [-output \u003coutput-directory\u003e]\n```\n\nThe `filepath` flag specifies the location of the Sigma, Yara, or IOC rules. This can be a file or directory path.\n\nThe `filecontent` flag allows you to provide the Base64-encoded content of Sigma, Yara, or IOC rules directly as a string.\n\nThe `config` flag specifies the location of the configuration file for CRYPTTECH's SIEM product.\n\nThe `configcontent` flag allows you to provide the Base64-encoded content of the configuration file directly as a string.\n\nThe `json` flag indicates that the output should be in JSON format.\n\nThe `output` flag specifies the directory where the output files should be written.\n\nIf the `json` flag is provided, Alterix will convert the Sigma, Yara, and IOC rules to JSON format. If the `output` flag is provided, Alterix will save the output files to the specified directory. If neither flag is provided, the output will be displayed in the console.\n\n## Demo\n\nCheck out a quick demo of Alterix in action:\n\n![Alterix Demo](images/alterix.gif)\n\n## Contributing\n\nContributions to Alterix are welcome and encouraged! Please read the [contribution guidelines](CONTRIBUTING.md) before making any contributions to the project.\n\n## Acknowledgements\n\nThis project was inspired by the work of Bradley Kemp, whose original repository can be found [here](https://github.com/bradleyjkemp/sigma-go). We would like to thank Bradley for his valuable contribution to the community and for making his code available to us.\n\nWe also want to express our gratitude to the creators of the Sigma, Yara as their rule formats form the backbone of this project. More information about Sigma can be found [here](https://github.com/Neo23x0/sigma), about Yara [here](https://github.com/VirusTotal/yara).\n\nAdditionally, we appreciate the efforts of the [VirusTotal Yara parser project](https://github.com/VirusTotal/gyp) for their work on Yara parsing, which has been instrumental in the development of this tool.\n\n\n## License\n\nAlterix is licensed under the MIT License. See [LICENSE](LICENSE) for the full text of the license.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmtnmunuklu%2Falterix","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmtnmunuklu%2Falterix","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmtnmunuklu%2Falterix/lists"}