kibune

A Sigma based detection pipeline.

(Note: this project is in an alpha state)

What is for

• To test a generic Sigma rule
• To create a Sigma based detection pipeline

Features

• Manage Sigma rules
• Evaluate Sigma rules with a given input & record alerts
• Emit alerts (send HTTP requests based on alerts)

Docs

• Overview
• Setup
• Usage
• Known limitations

Acknowledgements

• A forked version of CybercentreCanada/pysigma is used to evaluate a Sigma rule.