{"id":13845309,"url":"https://github.com/wagga40/Zircolite","last_synced_at":"2025-07-12T02:30:46.063Z","repository":{"id":37698827,"uuid":"343939740","full_name":"wagga40/Zircolite","owner":"wagga40","description":"A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs","archived":false,"fork":false,"pushed_at":"2025-03-30T13:08:19.000Z","size":63998,"stargazers_count":705,"open_issues_count":2,"forks_count":96,"subscribers_count":25,"default_branch":"master","last_synced_at":"2025-03-30T13:33:10.483Z","etag":null,"topics":["auditd","detection","evtx","evtxtract","forensics","forensics-tools","pysigma","python3","sigma","sigma-rules","sysmon"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/wagga40.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-03-02T23:17:06.000Z","updated_at":"2025-03-30T13:08:23.000Z","dependencies_parsed_at":"2023-02-15T06:01:17.859Z","dependency_job_id":"46e893b3-9786-4221-b5f5-ec839c38d80b","html_url":"https://github.com/wagga40/Zircolite","commit_stats":null,"previous_names":[],"tags_count":37,"template":false,"template_full_name":null,"purl":"pkg:github/wagga40/Zircolite","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wagga40%2FZircolite","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wagga40%2FZircolite/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wagga40%2FZircolite/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wagga40%2FZircolite/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/wagga40","download_url":"https://codeload.github.com/wagga40/Zircolite/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wagga40%2FZircolite/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264925440,"owners_count":23684151,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["auditd","detection","evtx","evtxtract","forensics","forensics-tools","pysigma","python3","sigma","sigma-rules","sysmon"],"created_at":"2024-08-04T17:03:19.706Z","updated_at":"2025-07-12T02:30:46.031Z","avatar_url":"https://github.com/wagga40.png","language":"Python","funding_links":[],"categories":["IR Tools Collection","Other Lists","Python","Critical tools for CSIRT"],"sub_categories":["Log Analysis Tools","🛡️ DFIR:","SOC architecture of detection"],"readme":"# \u003cp align=\"center\"\u003e![](pics/zircolite_400.png)\u003c/p\u003e\n\n## Standalone SIGMA-based detection tool for EVTX, Auditd, Sysmon for linux, XML, CSV or JSONL/NDJSON Logs \n![](pics/Zircolite_v2.9.gif)\n\n[![python](https://img.shields.io/badge/python-3.10-blue)](https://www.python.org/)\n![version](https://img.shields.io/badge/Architecture-64bit-red)\n\n**Zircolite** is a standalone tool written in Python 3 that allows you to use SIGMA rules on:\n\n- MS Windows EVTX (EVTX, XML, and JSONL formats)\n- Auditd logs\n- Sysmon for Linux\n- EVTXtract\n- CSV and XML logs\n- JSON Array logs\n\n### Key Features\n\n- **Fast Processing**: Zircolite is relatively fast and can parse large datasets in just seconds.\n- **SIGMA Backend**: It is based on a SIGMA backend (SQLite) and does not use internal SIGMA-to-something conversion.\n- **Advanced Log Manipulation**: It can manipulate input logs by splitting fields and applying transformations, allowing for more flexible and powerful log analysis.\n- **Flexible Export**: Zircolite can export results to multiple formats using Jinja [templates](templates), including JSON, CSV, JSONL, Splunk, Elastic, Zinc, Timesketch, and more.\n- **Multiple Input Formats**: Support for various log formats including EVTX, JSON Lines, JSON Arrays, CSV, XML, and more.\n\n**You can use Zircolite directly in Python or use the binaries provided in the [releases](https://github.com/wagga40/Zircolite/releases).** \n\n**Documentation is available [here](https://wagga40.github.io/Zircolite/) (dedicated site) or [here](docs) (repo directory).**\n\n## Requirements / Installation\n\nThe project has only been tested with Python 3.10. If you only want to use base functionnalities of Zircolite, you can install dependencies with : `pip3 install -r requirements.txt`. But `pip3 install -r requirements.full.txt` is strongly recommended.\n\nThe use of [evtx_dump](https://github.com/omerbenamram/evtx) is **optional but required by default (because it is -for now- much faster)**, If you do not want to use it you have to use the `--noexternal` option. The tool is provided if you clone the Zircolite repository (the official repository is [here](https://github.com/omerbenamram/evtx)).\n\n:warning: On some systems (Mac, Arm, ...) the `evtx` Python library may need Rust and Cargo to be installed.\n\n## Quick start\n\nCheck tutorials made by other (EN, SP and FR) [here](#tutorials).\n\n### EVTX files : \n\nHelp is available with:\n\n```shell\npython3 zircolite.py -h\n```\n\nIf your EVTX files have the extension \".evtx\" :\n\n```shell\n# python3 zircolite.py --evtx \u003cEVTX FOLDER or EVTX FILE\u003e --ruleset \u003cSIGMA RULESET\u003e [--ruleset \u003cOTHER RULESET\u003e]\npython3 zircolite.py --evtx sysmon.evtx --ruleset rules/rules_windows_sysmon_pysigma.json\n```\n\n### Other Log Formats:\n\n```shell\n# For Auditd logs\npython3 zircolite.py --events auditd.log --ruleset rules/rules_linux.json --auditd\n\n# For Sysmon for Linux logs\npython3 zircolite.py --events sysmon.log --ruleset rules/rules_linux.json --sysmon4linux\n\n# For JSONL or NDJSON logs\npython3 zircolite.py --events \u003cJSON_FOLDER_OR_FILE\u003e --ruleset rules/rules_windows_sysmon_pysigma.json --jsononly\n\n# For JSON Array logs\npython3 zircolite.py --events \u003cJSON_FOLDER_OR_FILE\u003e --ruleset rules/rules_windows_sysmon_pysigma.json --json-array\n\n# For CSV logs\npython3 zircolite.py --events \u003cCSV_FOLDER_OR_FILE\u003e --ruleset rules/rules_windows_sysmon_pysigma.json --csv-input\n\n# For XML logs\npython3 zircolite.py --events \u003cXML_FOLDER_OR_FILE\u003e --ruleset rules/rules_windows_sysmon_pysigma.json --xml-input\n```\n\n- The `--events` argument can be a file or a folder. If it is a folder, all EVTX files in the current folder and subfolders will be selected.\n- The SYSMON ruleset used is a default one, intended for analyzing logs from endpoints with SYSMON installed.\n\n\u003e [!TIP]\n\u003e If you want to try the tool you can test with [EVTX-ATTACK-SAMPLES](https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES) (EVTX Files).\n\n### Running with Docker\n\n```bash\n# Pull docker image\ndocker pull wagga40/zircolite:latest\n# If your logs and rules are in a specific directory\ndocker run --rm --tty \\\n    -v $PWD:/case/input:ro \\\n    -v $PWD:/case/output \\\n    wagga40/zircolite:latest \\\n    -e /case/input \\\n    -o /case/output/detected_events.json \\\n    -r /case/input/a_sigma_rule.yml\n```\n\n- Replace `$PWD` with the directory (absolute path only) where your logs and rules/rulesets are stored.\n\n### Updating default rulesets\n\n```shell\npython3 zircolite.py -U\n```\n\n\u003e [!IMPORTANT]  \n\u003e Please note these rulesets are provided to use Zircolite out-of-the-box, but [you should generate your own rulesets](#why-you-should-build-your-own-rulesets) as they can be very noisy or slow. These auto-updated rulesets are available in the dedicated repository: [Zircolite-Rules](https://github.com/wagga40/Zircolite-Rules).\n\n## Docs\n\nComplete documentation is available [here](docs).\n\n## Mini-Gui\n\nThe Mini-GUI can be used totally offline. It allows you to display and search results. You can automatically generate a Mini-GUI \"package\" with the `--package` option. To learn how to use the Mini-GUI, check the docs [here](docs/Advanced.md#mini-gui).\n\n### Detected events by Mitre Att\u0026ck (c) techniques and criticity levels\n\n![](pics/gui.webp)\n\n### Detected events Timeline\n\n![](pics/gui-timeline.webp)\n\n### Detected events by Mitre Att\u0026ck (c) techniques displayed on the Matrix \n\n![](pics/gui-matrix.webp)\n\n## Tutorials, references and related projects\n\n### Tutorials\n\n- **English**: [Russ McRee](https://holisticinfosec.io) has published a detailed [tutorial](https://holisticinfosec.io/post/2021-09-28-zircolite/) on SIGMA and Zircolite on his blog.\n\n- **Spanish**: **César Marín** has published a tutorial in Spanish [here](https://derechodelared.com/zircolite-ejecucion-de-reglas-sigma-en-ficheros-evtx/).\n\n- **French**: [IT-connect.fr](https://www.it-connect.fr/) has published [an extensive tutorial](https://www.it-connect.fr/) on Zircolite in French.\n\n- **French**: [IT-connect.fr](https://www.it-connect.fr/) has also published a [Hack the Box challenge Write-Up](https://www.it-connect.fr/hack-the-box-sherlocks-tracer-solution/) using Zircolite.\n\n### References \n\n- [Florian Roth](https://github.com/Neo23x0/) cited Zircolite in his [**SIGMA Hall of Fame**](https://github.com/Neo23x0/Talks/blob/master/Sigma_Hall_of_Fame_20211022.pdf) during his talk at the October 2021 EU ATT\u0026CK Workshop.\n- Zircolite has been cited and presented during [JSAC 2023](https://jsac.jpcert.or.jp/archive/2023/pdf/JSAC2023_workshop_sigma_jp.pdf).\n- Zircolite has been cited and used in multiple research papers:\n  - **CIDRE Team**:\n    - [PWNJUTSU - Website](https://pwnjutsu.irisa.fr)\n    - [PWNJUTSU - Academic Paper](https://hal.inria.fr/hal-03694719/document)\n    - [CERBERE: Cybersecurity Exercise for Red and Blue Team Entertainment, Reproducibility](https://centralesupelec.hal.science/hal-04285565/file/CERBERE_final.pdf)\n  - **Universidad de la República**:\n    - [A Process Mining-Based Method for Attacker Profiling Using the MITRE ATT\u0026CK Taxonomy](https://journals-sol.sbc.org.br/index.php/jisa/article/view/3902/2840)\n\n---\n\n## License\n\n- All the **code** of the project is licensed under the [GNU Lesser General Public License](https://www.gnu.org/licenses/lgpl-3.0.en.html).\n- `evtx_dump` is under the MIT license.\n- The rules are released under the [Detection Rule License (DRL) 1.0](https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md).\n\n---\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwagga40%2FZircolite","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwagga40%2FZircolite","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwagga40%2FZircolite/lists"}