A Dockerized version of pySigma-backend-sentinelone for quickly converting Sigma rules into SentinelOne queries.
Convert a Sigma rule:
❯ cat proc_creation_win_malware_coldsteel_anonymous_process.yml | docker run --rm -i jakewarren/pysigma-sentinelone
EventType = "Process Creation" AND (EndpointOS = "windows" AND ((SrcProcImagePath containsCIS "\Windows\System32\" OR SrcProcImagePath containsCIS "\AppData\") AND TgtProcUser containsCIS "ANONYMOUS"))
Content type
Image
Digest
sha256:9228fc38a…
Size
55.3 MB
Last updated
about 3 years ago
docker pull jakewarren/pysigma-sentinelone