File tree

• docker-compose.yml
• siem-converter/app/converter
  • core
    • functions.py
    • models
      • functions
        • aggregation.py
        • search.py
        • sort.py
        • table.py
        • types.py
        • union.py
        • where.py
      • identifier.py
  • platforms
    • __init__.py
    • logscale/siem_functions
      • __init__.py
    • splunk/siem_functions
      • __init__.py
• translator
  • .gitignore
  • Dockerfile
  • app
    • __init__.py
    • dictionaries
      • uncoder_meta_info_roota.json
      • uncoder_meta_info_sigma.json
    • models
      • __init__.py
      • ioc_translation.py
      • translation.py
    • routers
      • __init__.py
      • assistance.py
      • ioc_translate.py
      • translate.py
    • translator
      • __init__.py
      • const.py
      • core
        • __init__.py
        • custom_types
          • __init__.py
          • functions.py
          • tokens.py
        • exceptions
          • __init__.py
          • core.py
          • functions.py
          • iocs.py
          • parser.py
          • render.py
        • functions.py
        • mapping.py
        • mitre.py
        • mixins
          • __init__.py
          • logic.py
          • operator.py
          • rule.py
        • models
          • __init__.py
          • field.py
          • functions
            • __init__.py
            • base.py
            • sort.py
          • identifier.py
          • iocs.py
          • parser_output.py
          • platform_details.py
        • parser.py
        • parser_cti.py
        • render.py
        • render_cti.py
        • tokenizer.py
      • cti_translator.py
      • managers.py
      • mappings
        • __init__.py
        • platforms
          • athena
            • aws_cloudtrail.yml
            • default.yml
            • linux_file_event.yml
            • linux_process_creation.yml
            • macos_file_event.yml
            • macos_process_creation.yml
            • windows_file_event.yml
            • windows_image_load.yml
            • windows_process_creation.yml
            • windows_registry_event.yml
            • windows_security.yml
          • chronicle
            • default.yml
            • windows_create_remote_thread.yml
            • windows_dns_query.yml
            • windows_file_event.yml
            • windows_image_load.yml
            • windows_network_connection.yml
            • windows_pipe_created.yml
            • windows_process_access.yml
            • windows_process_creation.yml
            • windows_registry_event.yml
            • windows_security.yml
            • windows_sysmon.yml
          • crowdstrike
            • default.yml
            • linux_dns_query.yml
            • linux_network_connection.yml
            • linux_process_creation.yml
            • macos_dns_query.yml
            • macos_network_connection.yml
            • macos_process_creation.yml
            • windows_dns_query.yml
            • windows_driver_load.yml
            • windows_image_load.yml
            • windows_network_connection.yml
            • windows_process_creation.yml
            • windows_registry_event.yml
            • windows_sysmon.yml
          • elasticsearch
            • aws_cloudtrail.yml
            • aws_eks.yml
            • azure_AzureDiagnostics.yml
            • azure_BehaviorAnalytics.yml
            • azure_aadnoninteractiveusersigninlogs.yml
            • azure_azureactivity.yml
            • azure_azuread.yml
            • azure_m365.yml
            • azure_signinlogs.yml
            • default.yml
            • dns.yml
            • firewall.yml
            • gcp_gcp.audit.yml
            • gcp_pubsub.yml
            • linux_auditd.yml
            • linux_dns_query.yml
            • linux_process_creation.yml
            • macos_dns_query.yml
            • macos_network_connection.yml
            • macos_process_creation.yml
            • okta_okta.yml
            • proxy.yml
            • webserver.yml
            • windows_bits_client.yml
            • windows_dns_query.yml
            • windows_driver_load.yml
            • windows_image_load.yml
            • windows_ldap_debug.yml
            • windows_network_connection.yml
            • windows_ntlm.yml
            • windows_powershell.yml
            • windows_process_creation.yml
            • windows_security.yml
            • windows_sysmon.yml
            • windows_wmi_event.yml
          • logscale
            • aws_cloudtrail.yml
            • aws_eks.yml
            • azure_AzureDiagnostics.yml
            • azure_BehaviorAnalytics.yml
            • azure_aadnoninteractiveusersigninlogs.yml
            • azure_azureactivity.yml
            • azure_azuread.yml
            • azure_m365.yml
            • azure_signinlogs.yml
            • default.yml
            • dns.yml
            • firewall.yml
            • gcp_gcp.audit.yml
            • gcp_pubsub.yml
            • linux_auditd.yml
            • linux_dns_query.yml
            • linux_process_creation.yml
            • macos_dns_query.yml
            • macos_network_connection.yml
            • macos_process_creation.yml
            • okta_okta.yml
            • proxy.yml
            • webserver.yml
            • windows_application.yml
            • windows_bits_client.yml
            • windows_create_remote_thread.yml
            • windows_create_stream_hash.yml
            • windows_dns_query.yml
            • windows_driver_load.yml
            • windows_file_event.yml
            • windows_image_load.yml
            • windows_ldap_debug.yml
            • windows_network_connection.yml
            • windows_ntlm.yml
            • windows_pipe_created.yml
            • windows_powershell.yml
            • windows_process_access.yml
            • windows_process_creation.yml
            • windows_raw_access_thread.yml
            • windows_registry_event.yml
            • windows_security.yml
            • windows_sysmon.yml
            • windows_system.yml
            • windows_wmi_event.yml
          • microsoft_defender
            • default.yml
            • linux_file_event.yml
            • linux_network_connection.yml
            • macos_file_event.yml
            • macos_network_connection.yml
            • macos_process_creation.yml
            • windows_file_event.yml
            • windows_image_load.yml
            • windows_network_connection.yml
            • windows_process_creation.yml
            • windows_registry_event.yml
            • windows_sysmon.yml
          • microsoft_sentinel
            • aws_cloudtrail.yml
            • aws_eks.yml
            • azure_AzureDiagnostics.yml
            • azure_BehaviorAnalytics.yml
            • azure_aadnoninteractiveusersigninlogs.yml
            • azure_azureactivity.yml
            • azure_azuread.yml
            • azure_m365.yml
            • azure_o365.yml
            • azure_office365.yml
            • azure_signlogs.yml
            • default.yml
            • linux_auidt.yml
            • linux_dns_query.yml
            • linux_file_event.yml
            • linux_network_connection.yml
            • linux_process_creation.yml
            • macos_file_event.yml
            • macos_network_connection.yml
            • macos_process_creation.yml
            • okta_okta.yml
            • windows_bits_client.yml
            • windows_dns_query.yml
            • windows_driver_load.yml
            • windows_file_event.yml
            • windows_image_load.yml
            • windows_ldap_debug.yml
            • windows_network_connection.yml
            • windows_ntlm.yml
            • windows_powershell.yml
            • windows_process_creation.yml
            • windows_registry_event.yml
            • windows_security.yml
            • windows_sysmon.yml
            • windows_wmi_event.yml
          • opensearch
            • aws_cloudtrail.yml
            • aws_eks.yml
            • azure_AzureDiagnostics.yml
            • azure_BehaviorAnalytics.yml
            • azure_aadnoninteractiveusersigninlogs.yml
            • azure_azureactivity.yml
            • azure_azuread.yml
            • azure_m365.yml
            • azure_signinlogs.yml
            • default.yml
            • dns.yml
            • firewall.yml
            • gcp_gcp.audit.yml
            • gcp_pubsub.yml
            • linux_auditd.yml
            • linux_dns_query.yml
            • linux_process_creation.yml
            • macos_dns_query.yml
            • macos_network_connection.yml
            • macos_process_creation.yml
            • okta_okta.yml
            • proxy.yml
            • webserver.yml
            • windows_bits_client.yml
            • windows_dns_query.yml
            • windows_driver_load.yml
            • windows_image_load.yml
            • windows_ldap_debug.yml
            • windows_network_connection.yml
            • windows_ntlm.yml
            • windows_powershell.yml
            • windows_process_creation.yml
            • windows_security.yml
            • windows_sysmon.yml
            • windows_wmi_event.yml
          • qradar
            • aws_cloudtrail.yml
            • aws_eks.yml
            • azure_azureactivity.yml
            • azure_azuread.yml
            • azure_m365.yml
            • azure_signinlogs.yml
            • default.yml
            • dns.yml
            • firewall.yml
            • gcp_gcp.audit.yml
            • linux_auditd.yml
            • linux_dns_query.yml
            • linux_file_event.yml
            • linux_network_connection.yml
            • linux_process_creation.yml
            • macos_dns_query.yml
            • macos_file_event.yml
            • macos_network_connection.yml
            • macos_process_creation.yml
            • okta_okta.yml
            • proxy.yml
            • webserver.yml
            • windows_application.yml
            • windows_create_remote_thread.yml
            • windows_create_stream_hash.yml
            • windows_dns_query.yml
            • windows_driver_load.yml
            • windows_file_event.yml
            • windows_image_load.yml
            • windows_ldap_debug.yml
            • windows_network_connection.yml
            • windows_ntlm.yml
            • windows_pipe_created.yml
            • windows_powershell.yml
            • windows_process_access.yml
            • windows_process_creation.yml
            • windows_raw_access_thread.yml
            • windows_registry_event.yml
            • windows_security.yml
            • windows_sysmon.yml
            • windows_system.yml
            • windows_wmi_event.yml
          • sigma
            • aws_cloudtrail.yml
            • aws_eks.yml
            • azure_AzureDiagnostics.yml
            • azure_BehaviorAnalytics.yml
            • azure_aadnoninteractiveusersigninlogs.yml
            • azure_azureactivity.yml
            • azure_azuread.yml
            • azure_m365.yml
            • azure_signinlogs.yml
            • default.yml
            • dns.yml
            • firewall.yml
            • gcp_gcp.audit.yml
            • gcp_pubsub.yml
            • linux_auditd.yml
            • linux_dns_query.yml
            • linux_network_connection.yml
            • linux_process_creation.yml
            • macos_dns_query.yml
            • macos_network_connection.yml
            • macos_process_creation.yml
            • okta_okta.yml
            • proxy.yml
            • webserver.yml
            • windows_bits_client.yml
            • windows_dns_query.yml
            • windows_driver_load.yml
            • windows_image_load.yml
            • windows_ldap_debug.yml
            • windows_network_connection.yml
            • windows_ntlm.yml
            • windows_powershell.yml
            • windows_process_creation.yml
            • windows_security.yml
            • windows_sysmon.yml
            • windows_wmi_event.yml
          • splunk
            • aws_cloudtrail.yml
            • aws_eks.yml
            • azure_AzureDiagnostics.yml
            • azure_BehaviorAnalytics.yml
            • azure_aadnoninteractiveusersigninlogs.yml
            • azure_azureactivity.yml
            • azure_azuread.yml
            • azure_signinlogs.yml
            • default.yml
            • gcp_gcp.audit.yml
            • gcp_pubsub.yml
            • linux_auditd.yml
            • linux_dns_query.yml
            • linux_file_access.yml
            • linux_file_change.yml
            • linux_file_create.yml
            • linux_file_delete.yml
            • linux_file_event.yml
            • linux_file_rename.yml
            • linux_network_connection.yml
            • linux_process_creation.yml
            • macos_dns_query.yml
            • macos_file_access.yml
            • macos_file_change.yml
            • macos_file_delete.yml
            • macos_file_event.yml
            • macos_file_rename.yml
            • macos_network_connection.yml
            • macos_process_creation.yml
            • okta_okta.yml
            • windows_bits_client.yml
            • windows_dns_query.yml
            • windows_driver_load.yml
            • windows_file_access.yml
            • windows_file_change.yml
            • windows_file_create.yml
            • windows_file_delete.yml
            • windows_file_event.yml
            • windows_file_rename.yml
            • windows_image_load.yml
            • windows_ldap_debug.yml
            • windows_network_connection.yml
            • windows_ntlm.yml
            • windows_powershell.yml
            • windows_process_creation.yml
            • windows_registry_event.yml
            • windows_security.yml
            • windows_sysmon.yml
            • windows_wmi_event.yml
        • utils
          • __init__.py
          • load_from_files.py
      • platforms
        • __init__.py
        • athena
          • __init__.py
          • const.py
          • mapping.py
          • mappings
            • __init__.py
            • athena_cti.py
          • parsers
            • __init__.py
            • athena.py
          • renders
            • __init__.py
            • athena.py
            • athena_cti.py
          • tokenizer.py
        • base
          • __init__.py
          • lucene
            • __init__.py
            • mapping.py
            • parsers
              • __init__.py
              • lucene.py
            • renders
              • __init__.py
              • lucene.py
            • tokenizer.py
          • spl
            • __init__.py
            • functions
              • __init__.py
              • const.py
              • manager.py
            • parsers
              • __init__.py
              • spl.py
            • renders
              • __init__.py
              • spl.py
            • tokenizer.py
        • carbonblack
          • __init__.py
          • const.py
          • mappings
            • __init__.py
            • carbonblack_cti.py
          • renders
            • __init__.py
            • carbonblack_cti.py
        • chronicle
          • __init__.py
          • const.py
          • mapping.py
          • mappings
            • __init__.py
            • chronicle_cti.py
          • parsers
            • __init__.py
            • chronicle.py
            • chronicle_rule.py
          • renders
            • __init__.py
            • chronicle.py
            • chronicle_cti.py
            • chronicle_rule.py
          • tokenizer.py
        • crowdstrike
          • __init__.py
          • const.py
          • functions
            • __init__.py
          • mapping.py
          • mappings
            • __init__.py
            • crowdstrike_cti.py
          • parsers
            • __init__.py
            • crowdstrike.py
          • renders
            • __init__.py
            • crowdstrike.py
            • crowdstrike_cti.py
        • elasticsearch
          • __init__.py
          • const.py
          • mapping.py
          • mappings
            • __init__.py
            • elasticsearch_cti_cti.py
          • parsers
            • __init__.py
            • detection_rule.py
            • elasticsearch.py
          • renders
            • __init__.py
            • detection_rule.py
            • elast_alert.py
            • elasticsearch.py
            • elasticsearch_cti.py
            • kibana.py
            • xpack_watcher.py
          • tokenizer.py
        • fireeye_helix
          • __init__.py
          • const.py
          • mappings
            • __init__.py
            • fireeye_helix.py
          • renders
            • __init__.py
            • fireeye_helix_cti.py
        • graylog
          • __init__.py
          • const.py
          • mappings
            • __init__.py
            • graylog_cti.py
          • renders
            • __init__.py
            • graylog_cti.py
        • logpoint
          • __init__.py
          • const.py
          • mappings
            • __init__.py
            • logpoint_cti.py
          • renders
            • __init__.py
            • logpoint_cti.py
        • logscale
          • __init__.py
          • const.py
          • functions
            • __init__.py
            • const.py
            • manager.py
          • mapping.py
          • mappings
            • __init__.py
            • logscale_cti.py
          • parsers
            • __init__.py
            • logscale.py
            • logscale_alert.py
          • renders
            • __init__.py
            • logscale.py
            • logscale_alert.py
            • logscale_cti.py
          • tokenizer.py
        • microsoft
          • __init__.py
          • const.py
          • functions
            • __init__.py
            • const.py
            • manager.py
          • mapping.py
          • mappings
            • __init__.py
            • mdatp_cti.py
            • microsoft_sentinel_cti.py
          • parsers
            • __init__.py
            • microsoft_defender.py
            • microsoft_sentinel.py
            • microsoft_sentinel_rule.py
          • renders
            • __init__.py
            • microsoft_defender.py
            • microsoft_defender_cti.py
            • microsoft_sentinel.py
            • microsoft_sentinel_cti.py
            • microsoft_sentinel_rule.py
          • siem_functions
            • __init__.py
            • base.py
          • tokenizer.py
        • opensearch
          • __init__.py
          • const.py
          • mapping.py
          • mappings
            • __init__.py
            • opensearch_cti.py
          • parsers
            • __init__.py
            • opensearch.py
          • renders
            • __init__.py
            • opensearch.py
            • opensearch_cti.py
            • opensearch_rule.py
          • tokenizer.py
        • qradar
          • __init__.py
          • const.py
          • mapping.py
          • mappings
            • __init__.py
            • qradar_cti.py
          • parsers
            • __init__.py
            • qradar.py
          • renders
            • __init__.py
            • qradar.py
            • qradar_cti.py
          • tokenizer.py
        • qualys
          • __init__.py
          • const.py
          • mappings
            • __init__.py
            • qualys_cti.py
          • renders
            • __init__.py
            • qualys_cti.py
        • roota
          • __init__.py
          • mapping.py
          • parsers
            • __init__.py
            • roota.py
        • rsa_netwitness
          • __init__.py
          • const.py
          • mappings
            • __init__.py
            • rsa_netwitness_cti.py
          • renders
            • __init__.py
            • rsa_netwitness_cti.py
        • securonix
          • __init__.py
          • const.py
          • mappings
            • __init__.py
            • securonix_cti.py
          • renders
            • __init__.py
            • securonix_cti.py
        • sentinel_one
          • __init__.py
          • const.py
          • mappings
            • __init__.py
            • s1_cti.py
          • renders
            • __init__.py
            • s1_cti.py
        • sigma
          • __init__.py
          • const.py
          • mapping.py
          • models
            • __init__.py
            • compiler.py
            • group.py
            • modifiers.py
            • operator.py
          • parsers
            • __init__.py
            • sigma.py
          • renders
            • __init__.py
            • sigma.py
          • tokenizer.py
        • snowflake
          • __init__.py
          • const.py
          • mappings
            • __init__.py
            • snowflake_cti.py
          • renders
            • __init__.py
            • snowflake_cti.py
        • splunk
          • __init__.py
          • const.py
          • functions
            • __init__.py
          • mapping.py
          • mappings
            • __init__.py
            • splunk_cti.py
          • parsers
            • __init__.py
            • splunk.py
            • splunk_alert.py
          • renders
            • __init__.py
            • splunk.py
            • splunk_alert.py
            • splunk_cti.py
        • sumo_logic
          • __init__.py
          • const.py
          • mappings
            • __init__.py
            • sumologic_cti.py
          • renders
            • __init__.py
            • sumologic_cti.py
      • tools
        • __init__.py
        • const.py
        • custom_enum.py
        • decorators.py
        • singleton_meta.py
        • utils.py
      • translator.py
  • const.py
  • requirements.txt
  • server.py
  • settings.py