{"id":28531456,"url":"https://github.com/muchdogesec/siemrules","last_synced_at":"2026-07-02T14:38:19.391Z","repository":{"id":273825720,"uuid":"866548071","full_name":"muchdogesec/siemrules","owner":"muchdogesec","description":"An API that takes a txt file containing threat intelligence and turns it into a detection rule.","archived":false,"fork":false,"pushed_at":"2026-06-16T15:57:03.000Z","size":746,"stargazers_count":4,"open_issues_count":4,"forks_count":3,"subscribers_count":2,"default_branch":"main","last_synced_at":"2026-06-16T17:26:42.789Z","etag":null,"topics":["detection-engineering","detection-rules","siem","soar"],"latest_commit_sha":null,"homepage":"https://www.siemrules.com/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/muchdogesec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-10-02T13:11:55.000Z","updated_at":"2026-06-16T15:55:04.000Z","dependencies_parsed_at":null,"dependency_job_id":"81001a0f-e9e9-40cf-9c3a-4b750f29cf3b","html_url":"https://github.com/muchdogesec/siemrules","commit_stats":null,"previous_names":["muchdogesec/siemrules"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/muchdogesec/siemrules","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/muchdogesec%2Fsiemrules","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/muchdogesec%2Fsiemrules/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/muchdogesec%2Fsiemrules/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/muchdogesec%2Fsiemrules/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/muchdogesec","download_url":"https://codeload.github.com/muchdogesec/siemrules/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/muchdogesec%2Fsiemrules/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35051882,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-02T02:00:06.368Z","response_time":173,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["detection-engineering","detection-rules","siem","soar"],"created_at":"2025-06-09T15:10:32.998Z","updated_at":"2026-07-02T14:38:19.383Z","avatar_url":"https://github.com/muchdogesec.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# SIEM Rules\n\n[![codecov](https://codecov.io/gh/muchdogesec/siemrules/graph/badge.svg?token=H4AF99P1TE)](https://codecov.io/gh/muchdogesec/siemrules)\n\n## Before you begin...\n\nWe offer a fully hosted web version of SIEM Rules which includes many additional features over those in this codebase. [You can find out more about the web version here](https://www.siemrules.com/).\n\n## Overview\n\nAn API that takes a file containing threat intelligence and turns it into a detection rule.\n\n## How it works\n\n1. User uploads files (these are typically threat intel reports)\n2. The file is converted to txt (using [file2txt](https://github.com/muchdogesec/file2txt))\n3. User inputs processed by [txt2detection](https://github.com/muchdogesec/txt2detection)\n4. Objects stored in ArangoDB using [stix2arango](https://github.com/muchdogesec/stix2arango) / Postgres for non STIX objects\n5. Objects exposed via API\n\n## Install\n\n### Download and configure\n\n```shell\n# clone the latest code\ngit clone https://github.com/muchdogesec/siemrules\n```\n\n### Pre-requisites\n\n**IMPORTANT**: ArangoDB and Postgres must be running. These are not deployed in the compose file.\n\nIf you are not sure what you are doing here, [follow the basic setup steps here](https://community.dogesec.com/t/best-way-to-create-databases-for-obstracts/153/2).\n\n### Configuration options\n\nSIEM Rules has various settings that are defined in an `.env` file.\n\nTo create a template for the file:\n\n```shell\ncp .env.example .env\n```\n\nTo see more information about how to set the variables, and what they do, read the `.env.markdown` file.\n\n### Build the Docker Image\n\n```shell\nsudo docker compose build\n```\n\n### Start the server\n\n```shell\nsudo docker compose up\n```\n\n### Access the server\n\nThe webserver (Django) should now be running on: http://127.0.0.1:8008/\n\nYou can access the Swagger UI for the API in a browser at: http://127.0.0.1:8008/api/schema/swagger-ui/\n\n## Contributing notes\n\nSIEM Rules is made up of different core external components that support most of its functionality.\n\nGenerally if you want to improve how SIEM Rules performs functionality, you should address the changes in;\n\n* [file2txt](https://github.com/muchdogesec/file2txt/): converts the file into a markdown file (which is used to extract data from)\n* [txt2detection](https://github.com/muchdogesec/txt2detection): turns the markdown file into detection rules / STIX objects\n* [stix2arango](https://github.com/muchdogesec/stix2arango): manages the logic to insert the STIX objects into the database\n\nFor anything else, then the Obstracts codebase is where you need to be :)\n\n## Support\n\n[Minimal support provided via the DOGESEC community](https://community.dogesec.com/).\n\n## License\n\n[Apache 2.0](/LICENSE).","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmuchdogesec%2Fsiemrules","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmuchdogesec%2Fsiemrules","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmuchdogesec%2Fsiemrules/lists"}