sigma

A Go implementation and parser for Sigma rules.

Import specific data sources into the Sigma generic and open signature format.

SysFlow edge processing pipeline

Converts Sigma, Yara rules and IOCs

f0_library — open security testing framework for AV/EDR evaluation, mapped to MITRE ATT&CK. Generates tests, detection rules (KQL/YARA/Sigma/EQL/LC), and defense guidance.

Implementation of OCSF Schemas in Golang

proof of concept intrusion mitigation tool written in go for windows. (Sysmon eventlogs and Sigma .yml signature rules)

A threat hunter that lives in your terminal with memories in Notion.

A digital signature scheme for signing Bitcoin transaction data

Generates synthetic logs for Sigma rules

Read-only triage UI for Rustinel EDR snapshots: merges alerts and telemetry into one process-aware killchain timeline. Go, embedded Redis, single binary.

All-in-one, open-source, self-hosted security platform. SIEM, IDS/IPS, SOAR, CTI, FIM & AI reports in one docker compose up.

A repository to store and manage CSIEM and SPL queries.

Go parser for Sigma detection rules (YAML) - extracts conditions, fields, and detection logic from Sigma rules

Automated server intrusion forensics tool — collects evidence via PowerShell/Bash, applies Sigma rules, and generates LLM-powered HTML reports with MITRE ATT&CK mapping.

Risk-driven detection validation: runs real Atomic Red Team tests in an isolated Wazuh lab, proves whether your Sigma rules catch them with attributable evidence, and measures false positives — replay any run without the lab.

Security posture scanner for AI coding agents: inventories MCP servers, detects plaintext secrets and risky configuration, captures runtime exposure, tracks baseline drift, and exports SARIF and Sigma.

Detection-as-code: author once, compile to Sigma / Elastic / Splunk

Self-hosted Sigma-powered SIEM: Go event-log agent, ingest server (chi+pgx/TimescaleDB), Next.js dashboard

Catches source-death and field-drift that volume-only SIEM monitors miss. Capability-gate model for detection engineering.