Home

Awesome

TALR_logo

Threat Alert Logic Repository (TALR)

A public repository for the collection and sharing of detection rules in STIX format. Collected rules are appended with STIX required fields for simplified sharing over TAXII servers.

Contains tools useful for translating rules from STIX to Sigma, and automating their ingestion/translation.

Projects in use / Thanks:

TALR Vision

Sharing SIEM Rules via STIX/TAXII, which enables:

stix2sigmac Requirements:

Only required if using tools.

  1. Python3 - required for pip sudo apt-get install python3
  2. Pip - required to install the things sudo apt-get install python3-pip
  3. JSON to YAML - required for stix2sigmac pip3 install json2yaml
  4. sigmatools - required for stix2sigmac pip3 install sigmatools
  5. OPTIONAL: figlet - for the intro banner sudo apt-get install figlet
  6. Reboot

Using stix2sigmac

stix2sigmac will parse through a STIX bundle, locate the detection rules, store them locally in yaml, and translate them to the SIEM query syntax specified.

To test this, we have made 2 bundles available in the /Bundles directory.

To unpack these bundles, run stix2sigmac against them, using the following syntax: ./stix2sigmac import [PRODUCT_TYPE or CATEGORY or SERVICE or ATTACK_TACTIC] [/DIRECTORY/WITH/STIX_BUNDLE/] [BUNDNLE_NAME.json] [/DIRECTORY/TO/PLACE_RULES/] [SIEM] [BACKEND_OPTIONS]

For [SIEM] and [BACKEND_OPTIONS] options available, please refer to the Sigma Tools page. Note: If using multiple backend options, comma seperate. If using none, simply write "none"

Example Steps to use stix2sigmac to unpack a bundle: (Tested on Ubuntu 18.04.1 with all requirements installed)

  1. Open a terminal session
  2. Clone the repository git clone https://github.com/SecurityRiskAdvisors/TALR.git
  3. Change into the directory of the script cd /location/of/repository/Tools/stix2sigmac
  4. Give the script permission to execute chmod +x stix2sigmac
  5. Translate the rules in the command line and export to the location of your choice in sigma (additional examples can be found in the stix2sigmac readme in /Tools/) ./stix2sigmac import windows ../../Bundles/ sra_bundle.json /LOCATION/OF/EXPORT/ splunk -Orulecomment=True

Execution should look like this: TALR_run

Goals:

Contributors:

Nick Ascoli, Zachary Santoro, Brandon Martin, Tyler Fredrick, Kevin Foster

Slides from "Keeping Up With the Joneses: SIEM Rules Edition"