Generation of IOC hunting queries from a raw list of IOC's for multiple different SIEM products
Open
feature
- Dominant language
- JavaScript
- Stars
- 35.8k
- Forks
- 4.1k
- Avg merge
- 2d 26m
- Merged PRs (30d)
- 33
Description
A fast and easy way to generate hunting queries for multiple different SIEM products from a raw list of IOC's and have the ability to convert hunting queries from one SIEM product to another.
EG - IOC list of: https://firstIOC.com, https://secondIOC.com
Would become
Sentinel: union * | where (RequestURL =~ 'https://firstIOC.com' or RequestURL =~ 'https://secondIOC.com')
Splunk: (url="https://firstIOC.com" OR url="https://secondIOC.com")
Elastic: url.original:("https://firstIOC.com" OR "https://secondIOC.com")
CrowdStrike: (HttpUrl="https://firstIOC.com" OR HttpUrl="https://secondIOC.com")
Contributor guide
Assessment
This issue has not been assessed yet.