Zircolite
SIEM & Threat DetectionA standalone Python tool that applies SIGMA detection rules to diverse log formats including EVTX, Auditd, Sysmon for Linux, CSV, XML, and JSON logs.
Features
- Automatic log type detection via magic bytes, content analysis, and regex fallback
- Supports multiple input formats (EVTX, JSON Lines/Array, CSV, XML) with archive handling
- Native Sigma rule support using pySigma conversion
- SQLite‑backed SIGMA backend for efficient rule application
- Custom field transforms (e.g., Base64 decoding) and flexible export via Jinja templates
Recent releases
View all 15 releases →
v3.6.3
Bug fix
A patch to the streaming module fixes a runtime error, improving reliability for data pipelines that process continuous streams.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Install & Platforms
Install via
pip
Platforms
linux
macos
arm64
