Skip to content

Commit

Permalink
Brought README up-to-date with the newest devs
Browse files Browse the repository at this point in the history
  • Loading branch information
Neo23x0 authored Mar 27, 2017
1 parent c5323ac commit adbeff5
Showing 1 changed file with 11 additions and 2 deletions.
13 changes: 11 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -88,14 +88,23 @@ Windows 'Security' Eventlog: Suspicious Number of Failed Logons from a Single So
The beta version of the rule converter 'sigmac' converting a non-correlation rule into an ElasticSearch query
![sigmac_converter](./images/Sigmac-win_susp_rc4_kerberos.png)

## Supported Targets

* [Splunk](https://www.splunk.com/)
* [ElasticSearch](https://www.elastic.co/)
* [Logpoint](https://www.logpoint.com)

# Next Steps

* Creation of a reasonable set of sample rules
* Release of the first rule converters for ElasticSearch and Splunk
* Integration of feedback into the rule specifications
* Integration into Threat Intel Exchanges, e.g. [MISP](http://www.misp-project.org/)
* Attempts to convince others to use the rule format in their reports, threat feeds, blog posts, threat sharing platforms

# Projects that use Sigma

* [Augmentd](https://augmentd.co/)
* [TA-Sigma-Searches](https://github.com/dstaulcu/TA-Sigma-Searches) (Splunk App)

# Credits

This is a private project mainly developed by Florian Roth and Thomas Patzke with feedback from many fellow analysts and friends. Rules are our own or have been drived from blog posts, tweets or other public sources that are referenced in the rules.
Expand Down

0 comments on commit adbeff5

Please sign in to comment.