SigmaTACT is a tool that converts Sigma rules into structured formats based on specific columns and generates actionable reports for enhanced threat visibility.

• SigmaTACT
  • 📚 Table of Contents
  • Introduction
  • Features
  • Installation
  • Usage
    • Convert Sigma Rules
    • Generate a Report
    • Example Workflow
  • Contributing
  • License

SigmaTACT is designed to transform Sigma rules into structured data based on predefined columns (e.g., log sources, MITRE ATT&CK tactics/techniques, or other custom attributes). This structured data can then be analyzed to produce detailed reports, helping security teams identify threats more effectively and align their detections with organizational priorities.

• 🛠️ Sigma Rule Transformation: Convert Sigma rules into structured formats tailored to specific columns or attributes.
• 📊 Advanced Reporting: Generate detailed, visually rich reports from the converted data for analysis and decision-making.
• 🔄 Support for Various Columns: Organize rules by log source, tactic, technique, or other custom criteria.
• 🤝 Seamless Integration: Integrate with existing workflows and tools for smoother operations.

To install SigmaTACT, clone the repository and install the necessary dependencies:

git clone https://github.com/yourusername/SigmaTACT.git
cd SigmaTACT
pip install -r requirements.txt

SigmaTACT provides an easy-to-use interface to transform and analyze Sigma rules.

Use the following command to convert Sigma rules into a structured format based on specified columns:

python SigmaTACT-Converter.py --input-dir /path/to/sigma/rules --output-dir /path/to/output

After converting the rules, you can generate a detailed report:

python SigmaTACT-Report.py

1. Conversion: First, use SigmaTACT-Converter.py to transform the Sigma rules.
2. Reporting: Next, use SigmaTACT-Report.py to generate a report from the transformed data.

We welcome contributions to SigmaTACT! Whether it's reporting issues, suggesting new features, or submitting pull requests, your help is appreciated.

1. Fork the repository.
2. Create a feature branch (git checkout -b feature/your-feature).
3. Commit your changes (git commit -m "Add your feature").
4. Push to the branch (git push origin feature/your-feature).
5. Open a pull request.

SigmaTACT is licensed under the MIT License. Feel free to use and modify it for your needs.

Happy Threat Hunting! 🛡️