https://github.com/muchdogesec/siemrules
An API that takes a txt file containing threat intelligence and turns it into a detection rule.
https://github.com/muchdogesec/siemrules
detection-engineering detection-rules siem soar
Last synced: 23 days ago
JSON representation
An API that takes a txt file containing threat intelligence and turns it into a detection rule.
- Host: GitHub
- URL: https://github.com/muchdogesec/siemrules
- Owner: muchdogesec
- License: apache-2.0
- Created: 2024-10-02T13:11:55.000Z (almost 2 years ago)
- Default Branch: main
- Last Pushed: 2026-06-16T15:57:03.000Z (about 1 month ago)
- Last Synced: 2026-06-16T17:26:42.789Z (about 1 month ago)
- Topics: detection-engineering, detection-rules, siem, soar
- Language: Python
- Homepage: https://www.siemrules.com/
- Size: 729 KB
- Stars: 4
- Watchers: 2
- Forks: 3
- Open Issues: 4
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# SIEM Rules
[](https://codecov.io/gh/muchdogesec/siemrules)
## Before you begin...
We offer a fully hosted web version of SIEM Rules which includes many additional features over those in this codebase. [You can find out more about the web version here](https://www.siemrules.com/).
## Overview
An API that takes a file containing threat intelligence and turns it into a detection rule.
## How it works
1. User uploads files (these are typically threat intel reports)
2. The file is converted to txt (using [file2txt](https://github.com/muchdogesec/file2txt))
3. User inputs processed by [txt2detection](https://github.com/muchdogesec/txt2detection)
4. Objects stored in ArangoDB using [stix2arango](https://github.com/muchdogesec/stix2arango) / Postgres for non STIX objects
5. Objects exposed via API
## Install
### Download and configure
```shell
# clone the latest code
git clone https://github.com/muchdogesec/siemrules
```
### Pre-requisites
**IMPORTANT**: ArangoDB and Postgres must be running. These are not deployed in the compose file.
If you are not sure what you are doing here, [follow the basic setup steps here](https://community.dogesec.com/t/best-way-to-create-databases-for-obstracts/153/2).
### Configuration options
SIEM Rules has various settings that are defined in an `.env` file.
To create a template for the file:
```shell
cp .env.example .env
```
To see more information about how to set the variables, and what they do, read the `.env.markdown` file.
### Build the Docker Image
```shell
sudo docker compose build
```
### Start the server
```shell
sudo docker compose up
```
### Access the server
The webserver (Django) should now be running on: http://127.0.0.1:8008/
You can access the Swagger UI for the API in a browser at: http://127.0.0.1:8008/api/schema/swagger-ui/
## Contributing notes
SIEM Rules is made up of different core external components that support most of its functionality.
Generally if you want to improve how SIEM Rules performs functionality, you should address the changes in;
* [file2txt](https://github.com/muchdogesec/file2txt/): converts the file into a markdown file (which is used to extract data from)
* [txt2detection](https://github.com/muchdogesec/txt2detection): turns the markdown file into detection rules / STIX objects
* [stix2arango](https://github.com/muchdogesec/stix2arango): manages the logic to insert the STIX objects into the database
For anything else, then the Obstracts codebase is where you need to be :)
## Support
[Minimal support provided via the DOGESEC community](https://community.dogesec.com/).
## License
[Apache 2.0](/LICENSE).