Tag: zircolite
-
Zircolite: fast SIGMA-based detection tool for EVTX or JSON Logs
Zircolite is a standalone tool written in Python 3 that allows you to use SIGMA rules on: MS Windows EVTX (EVTX, XML, and JSONL formats) Auditd logs Sysmon for Linux EVTXtract CSV and XML logs JSON Array logs Key Features Fast Processing: Zircolite is relatively fast and can parse large datasets in just seconds. SIGMA Backend:…