gchq / gchq/CyberChef

Generation of IOC hunting queries from a raw list of IOC's for multiple different SIEM products

Open
#1,381 0 comments 2 reactions 0 assignees View on GitHub
feature
Dominant language
JavaScript
Stars
35.8k
Forks
4.1k
Avg merge
2d 26m
Merged PRs (30d)
33

Description

A fast and easy way to generate hunting queries for multiple different SIEM products from a raw list of IOC's and have the ability to convert hunting queries from one SIEM product to another.

EG - IOC list of: https://firstIOC.com, https://secondIOC.com

Would become
Sentinel: union * | where (RequestURL =~ 'https://firstIOC.com' or RequestURL =~ 'https://secondIOC.com')
Splunk: (url="https://firstIOC.com" OR url="https://secondIOC.com")
Elastic: url.original:("https://firstIOC.com" OR "https://secondIOC.com")
CrowdStrike: (HttpUrl="https://firstIOC.com" OR HttpUrl="https://secondIOC.com")

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.