Release history
Zircolite releases
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
All releases
15 shown
A patch to the streaming module fixes a runtime error, improving reliability for data pipelines that process continuous streams.
The streaming module was patched to fix a data processing error, improving reliability for high-throughput pipelines.
Log analysis tool adds support for processing partially corrupted or malformed event log data instead of failing on errors, and introduces --strict flag for enforcing strict error handling.
- Auto-detected timestamp field matching
- CSV output column stability
- ZIP/7z archive processing
- ATT&CK Navigator template
- SARIF export format
- Timesketch export shortcut
- ECS field mappings
- Incremental result writing
- config/fieldMappings.yaml deprecated in favor of config/config.yaml
- New transform CLI options: --all-transforms, --transform-category, --transform-list
- UI/UX enhancements
- Windows and Linux rulesets updated
Full changelog
What's Changed
- UI/UX : Lot of enhancements in the UI/UX
- Transforms: New transforms added. Now transforms can be enabled with
--all-transforms,--transform-category,--transform-list - CSV output: Correct bug #114
- Config:
config/config.yamlis the default/canonical config;config/fieldMappings.yamlis deprecated (still supported, may be removed later). Docs and examples now referenceconfig.yaml - Rulesets: Windows and Linux rulesets updated
Full Changelog: https://github.com/wagga40/Zircolite/compare/v3.1.0...v3.2.0
- Content-based log type detection
- Multi-format support
- Rich library UI
Log analysis tool fixes pipeline order and priority handling to correctly process detection rules in the intended sequence.
Initial patch release for version 3.0 fixing oversight by including Linux rulesets in distribution.
- Dropped _full and _pysigma rulesets
- YAML-only field mappings
- Config format changed
- Early channel/EventID filtering
- Python field transforms
- Rich console UI