Zircolite is a standalone detection tool designed for Linux logs. It leverages the SIGMA rule format for detection, processing various log types including EVTX files, Auditd logs, and Sysmon outputs. The tool automatically detects log formats and supports extensive log manipulation capabilities, providing flexibility in analyzing system activity. It uses a SIGMA backend (SQLite) for rule execution and does not rely on internal conversions.
Zircolite distinguishes itself with automatic log format detection, a flexible approach to processing various log formats, and the ability to use native YAML Sigma rules. Its streamlined setup, rich terminal output with contextual information, and robust configuration options make it a powerful and adaptable detection solution.
- Log Format Detection: Automatically identifies log formats like EVTX, Auditd, and Sysmon logs.
- Multiple Input Types: Supports a wide range of log formats, including EVTX, CSV, XML, JSON, and more.
- SIGMA Rule Support: Leverages SIGMA rules for detection, simplifying rule management and updates.
- Advanced Log Manipulation: Enables field transformations and manipulations for customized log analysis.
- Flexible Export: Exports detection results to various formats like JSON, CSV, and Splunk.
- YAML Configuration: Provides a YAML configuration file for advanced workflow management.
- Parallel Processing: Optimizes processing based on system resources for faster analysis.
Zircolite is an actively maintained project with frequent updates and a growing community. The repository exhibits a healthy commit history and regular issue resolution. Comprehensive documentation is available, indicating a commitment to user support and ease of use. The project is considered reliable due to its extensive testing and clear design.
Zircolite benefits security analysts and DevOps professionals by providing a versatile tool for log analysis, enabling detection of malicious activity, compliance monitoring, and troubleshooting system issues. It provides an alternative to manual log review or complex SIEM setups, offering a lightweight and efficient approach to log-based detection.