Detection Rules Optimisation Integration Deployment
Project description
droid
droid
is a PySigma wrapper allowing an easy adoption of Sigma and helps enabling Detection-As-Code. The ultimate goal of droid
is to consume a repository Sigma rules and deploy them on one or multiple platform (SIEM/EDR). The tool also supports plain SIEM/EDR search queries.
🚀 Features
Key features are:
- Validate the syntax of Sigma rules
- Convert them by applying a set of transforms per log source and platform
- Search in logs and report on findings
- Test the rules by leveraging Atomic Red Team™ (work in progress)
- Deploy them with any compatible SIEM and EDR (.e.g. Splunk, Microsoft Sentinel)
🚂 Get started
To get started with the tool, visit the documentation page and configure droid
for your environment.
📚 Resources
License
Licensed under the EUPL.
Project details
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
detect_droid-0.1.5.tar.gz
(35.4 kB
view hashes)
Built Distribution
Close
Hashes for detect_droid-0.1.5-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | ae41cc5c782f6236e34e64e8f2e770e85773cae4c3aa4fe9f9bb2963d5a4e3f1 |
|
MD5 | 3df5b0eec5019a724059d372cb410962 |
|
BLAKE2b-256 | 0cb9e376efc85cd4c9eb6451412b70f78fbf8d7295e06fac3bfab0c930eb2967 |