diff --git a/Makefile b/Makefile index 27011d6..3479acb 100644 --- a/Makefile +++ b/Makefile @@ -3,7 +3,7 @@ DOCKER?=docker DOCKER_BUILD_FLAGS?= DOCKER_REGISTRY?=docker.io -DOCKER_TAG?=2.20.0 +DOCKER_TAG?=2.30.0 GIT?=git PY3?=python3 DATE=$(shell date +%s) diff --git a/docs/README.md b/docs/README.md index 1db681a..6b1a9fd 100644 --- a/docs/README.md +++ b/docs/README.md @@ -1,9 +1,18 @@ # Zircolite documentation -**Zircolite is a standalone tool written in Python 3. It allows to use SIGMA rules on : MS Windows EVTX (EVTX, XML and JSONL format), Auditd logs, Sysmon for Linux and EVTXtract logs** +**Zircolite** is a standalone tool written in Python 3 that allows you to use SIGMA rules on: -- **Zircolite** is relatively fast and can parse large datasets in just seconds -- **Zircolite** is based on a Sigma backend (SQLite) and do not use internal sigma to "something" conversion -- **Zircolite** can export results to multiple format with using Jinja : JSON, CSV, JSONL, Splunk, Elastic, Zinc, Timesketch... +- MS Windows EVTX (EVTX, XML, and JSONL formats) +- Auditd logs +- Sysmon for Linux +- EVTXtract +- CSV and XML logs -**Zircolite can be used directly in Python or you can use the binaries provided in [releases](https://github.com/wagga40/Zircolite/releases).** +### Key Features + +- **Fast Processing**: Zircolite is relatively fast and can parse large datasets in just seconds. +- **SIGMA Backend**: It is based on a SIGMA backend (SQLite) and does not use internal SIGMA-to-something conversion. +- **Advanced Log Manipulation**: It can manipulate input logs by splitting fields and applying transformations, allowing for more flexible and powerful log analysis. +- **Flexible Export**: Zircolite can export results to multiple formats using Jinja [templates](templates), including JSON, CSV, JSONL, Splunk, Elastic, Zinc, Timesketch, and more. + +**You can use Zircolite directly in Python or use the binaries provided in the [releases](https://github.com/wagga40/Zircolite/releases).** diff --git a/docs/Zircolite_manual.pdf b/docs/Zircolite_manual.pdf index cddbeb4..089776c 100644 Binary files a/docs/Zircolite_manual.pdf and b/docs/Zircolite_manual.pdf differ diff --git a/zircolite.py b/zircolite.py index 5c43845..db7a0d5 100755 --- a/zircolite.py +++ b/zircolite.py @@ -2000,7 +2000,7 @@ def ImportErrorHandler(config): # MAIN() ################################################################ def main(): - version = "2.20.0" + version = "2.30.0" # Init Args handling parser = argparse.ArgumentParser() diff --git a/zircolite_dev.py b/zircolite_dev.py index 473d4b2..3ea5c47 100755 --- a/zircolite_dev.py +++ b/zircolite_dev.py @@ -1506,7 +1506,7 @@ def ImportErrorHandler(config): # MAIN() ################################################################ def main(): - version = "2.20.0" + version = "2.30.0" # Init Args handling parser = argparse.ArgumentParser()