Static Code Analysis
Run Sigma rules over a folder of JSON events
zircolite is a standalone Sigma-based detection tool for EVTX, Auditd, Sysmon for Linux, XML, CSV, and JSON logs that runs Sigma rules offline by flattening events into SQLite, turning each rule into an SQL query, and reporting the matches in one command.
installdocker pull wagga40/zircolite:latestgit clone https://github.com/wagga40/Zircolite.git
Python
overview
What zircolite does
Zircolite takes two folders: JSON or JSONL events, and Sigma YAML rules. It writes a detection row when a rule matches an event.
Both folders are required. A rules folder of YAML is not a substitute for the events folder, and the reverse is also true.
Use sigma-cli first when you need to confirm a rule compiles. Use Zircolite when the logs are already in the workflow.
source github.com/wagga40/Zircolite
use cases
Where zircolite fits
Replay a detection on saved logs
Drop exported JSON events into the events folder and the Sigma pack into the rules folder.
Test one rule on one event
A single JSONL line and a single YAML rule are enough to see whether the rule fires.
Keep matches as rows
Downstream nodes can filter the detection file without re-running the rule engine.
reference
zircolite inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| events | FOLDER | --events | Folder of JSON or JSONL event logs. |
| rules | FOLDER | --rules | Folder of Sigma YAML rules. |
Showing key inputs. zircolite exposes 2 inputs in total.
example
Run zircolite
zircolite --events ./events --rules ./rules{"rule_title": "Whoami Process", "count": 1, "sample_event": {"CommandLine": "whoami"}}guidance
Choosing zircolite
Use Zircolite when you have JSON event logs and Sigma rules. Use sigma-cli when you only need the compiled query.
sigma-cli
Compiles Sigma YAML to a SIEM query without reading logs.
yara-x
Matches byte patterns in files rather than log events.
semgrep-scan
Matches rules against source code.
faq
zircolite questions
related
More Static Code Analysis tools
bandit
Python source in, JSON security findings out.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
guarddog
A package coordinate in, indicator hits out.
malcontent-scan
A package coordinate in, behavior findings out.
osv-malicious
A package coordinate in, malware advisory rows out.
Run zircolite yourself
A JSONL event whose command line is whoami is matched against a Sigma rule that looks for that command.
Facts on this page come from the live Trickest tool library.