Skip to content

Commit

Permalink
Bump version
Browse files Browse the repository at this point in the history
Update docs
  • Loading branch information
wagga40 committed Oct 13, 2024
1 parent 874dd08 commit d4ea2d8
Show file tree
Hide file tree
Showing 5 changed files with 17 additions and 8 deletions.
2 changes: 1 addition & 1 deletion Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
DOCKER?=docker
DOCKER_BUILD_FLAGS?=
DOCKER_REGISTRY?=docker.io
DOCKER_TAG?=2.20.0
DOCKER_TAG?=2.30.0
GIT?=git
PY3?=python3
DATE=$(shell date +%s)
Expand Down
19 changes: 14 additions & 5 deletions docs/README.md
Original file line number Diff line number Diff line change
@@ -1,9 +1,18 @@
# Zircolite documentation

**Zircolite is a standalone tool written in Python 3. It allows to use SIGMA rules on : MS Windows EVTX (EVTX, XML and JSONL format), Auditd logs, Sysmon for Linux and EVTXtract logs**
**Zircolite** is a standalone tool written in Python 3 that allows you to use SIGMA rules on:

- **Zircolite** is relatively fast and can parse large datasets in just seconds
- **Zircolite** is based on a Sigma backend (SQLite) and do not use internal sigma to "something" conversion
- **Zircolite** can export results to multiple format with using Jinja : JSON, CSV, JSONL, Splunk, Elastic, Zinc, Timesketch...
- MS Windows EVTX (EVTX, XML, and JSONL formats)
- Auditd logs
- Sysmon for Linux
- EVTXtract
- CSV and XML logs

**Zircolite can be used directly in Python or you can use the binaries provided in [releases](https://github.com/wagga40/Zircolite/releases).**
### Key Features

- **Fast Processing**: Zircolite is relatively fast and can parse large datasets in just seconds.
- **SIGMA Backend**: It is based on a SIGMA backend (SQLite) and does not use internal SIGMA-to-something conversion.
- **Advanced Log Manipulation**: It can manipulate input logs by splitting fields and applying transformations, allowing for more flexible and powerful log analysis.
- **Flexible Export**: Zircolite can export results to multiple formats using Jinja [templates](templates), including JSON, CSV, JSONL, Splunk, Elastic, Zinc, Timesketch, and more.

**You can use Zircolite directly in Python or use the binaries provided in the [releases](https://github.com/wagga40/Zircolite/releases).**
Binary file modified docs/Zircolite_manual.pdf
Binary file not shown.
2 changes: 1 addition & 1 deletion zircolite.py
Original file line number Diff line number Diff line change
Expand Up @@ -2000,7 +2000,7 @@ def ImportErrorHandler(config):
# MAIN()
################################################################
def main():
version = "2.20.0"
version = "2.30.0"

# Init Args handling
parser = argparse.ArgumentParser()
Expand Down
2 changes: 1 addition & 1 deletion zircolite_dev.py
Original file line number Diff line number Diff line change
Expand Up @@ -1506,7 +1506,7 @@ def ImportErrorHandler(config):
# MAIN()
################################################################
def main():
version = "2.20.0"
version = "2.30.0"

# Init Args handling
parser = argparse.ArgumentParser()
Expand Down

0 comments on commit d4ea2d8

Please # to comment.