Zircolite

https://wagga40.github.io/Zircolite/

Admin

Zircolite is a standalone SIGMA-based detection tool that processes EVTX, Auditd, Sysmon, CSV, XML,...

Tokens:600

Snippets:16

Trust Score:9.7

Update:6 months ago

Show doc for...

Tokens:

Raw

### Install Zircolite Dependencies

Source: https://wagga40.github.io/Zircolite

Install the required Python packages before running the tool.

```bash
pip3 install -r requirements.txt
```

--------------------------------

### Run Zircolite Analysis

Source: https://wagga40.github.io/Zircolite

Execute Zircolite with specified log files and rulesets.

```bash
python3 zircolite.py --events <logs> --ruleset <ruleset>
```

```bash
python3 zircolite.py --evtx sample.evtx --ruleset rules/rules_windows_merged.json
```

--------------------------------

### Task Automation Commands

Source: https://wagga40.github.io/Zircolite

Common commands for managing the project using Task.

```bash
task --list
```

```bash
task clean
```

```bash
task update-rules
```

```bash
task docker-build
```

```bash
task docker-build-multi-arch
```

```bash
task docker-push
```

```bash
task get-version
```

```bash
task save
```

Tokens:

Raw