Skip to content

Possibility of installation via pip added #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
florianutz wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Possibility of installation via pip added #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7bdaa1a
- add setup.py
Dec 21, 2019
ccb5ab0
- update README add pip command
Dec 21, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,11 @@ and generates a savedsearches.conf configuration. More information about the Sig
Sigma2SplunkAlert needs Sigma for converting the Sigma detection rules into Splunk searches. Sigma needs to be installed and part of the environment variables. Furthermore, Python >= 3.5, PyYAML and Jinja2 is needed.
The Sigma2SplunkAlert was tested with Splunk version 7.2.5. If you find some incompatibility to previous Splunk versions, open an issue and I will try to add the support as soon as possible.

# Installation

You can use pip to install sigma2splunkalert
`pip install git+https://github.com/P4T12ICK/Sigma2SplunkAlert.git`

# Usage
````
usage: sigma2splunkalert [-h] [--config CONFIG] [--sigma-config SIGMA_CONFIG]
Expand Down
35 changes: 35 additions & 0 deletions setup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
from setuptools import setup

setup (
name='sigma2splunkalert',
version='0.0.1',
packages=[''],
url='',
license='MIT',
author='',
author_email='',
description='sigma2splunkalert',
data_files=[
('bin/config' , [
'config/config.yml'
]),
('bin/templates' , [
'templates/template'
]),
('bin/sigma_config' , [
'sigma_config/splunk-all.yml'
]),
('bin/classes' , [
'classes/AlertManager.py',
'classes/DetectionRuleConverter.py',
'classes/EMail.py',
'classes/SummaryIndex.py',
'classes/TriggeredAlert.py',
'classes/UseCase.py'
])
],
install_requires=['pyYaml','jinja2','sigmatools'],
scripts=[
'sigma2splunkalert'
]
)
17 changes: 10 additions & 7 deletions sigma2splunkalert
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,14 +33,16 @@ def main(argv):
if cmdargs.config:
converter_config_path = cmdargs.config
else:
converter_config_path = 'config/config.yml'
#converter_config_path = 'config/config.yml'
converter_config_path = os.path.join(os.path.dirname ( __file__ ), 'config/config.yml')

# cmdargs Sigma Configuration
if cmdargs.sigma_config:
sigma_config_path = cmdargs.sigma_config
else:
sigma_config_path = 'sigma_config/splunk-all.yml'

#sigma_config_path = 'sigma_config/splunk-all.yml'
sigma_config_path = os.path.join(os.path.dirname ( __file__ ), 'sigma_config/splunk-all.yml')

# cmdargs template Configuration
if cmdargs.template:
template_path = cmdargs.template
Expand Down Expand Up @@ -79,18 +81,19 @@ def main(argv):
detection_rule = UseCase(sigma_rule, sigma2splunkalertconfig, splunk_search)
detection_rules.append(detection_rule)


# Use Jinja2 Templating for create configuration
if cmdargs.template:
file_loader = FileSystemLoader(os.path.dirname(template_path))
else:
file_loader = FileSystemLoader('templates')

#file_loader = FileSystemLoader('templates')
file_loader = FileSystemLoader(os.path.join( os.path.dirname ( __file__ ), 'templates' ))

env = Environment(loader=file_loader)
env.trim_blocks = True
env.lstrip_blocks = True
env.rstrip_blocks = True

if cmdargs.template:
template = env.get_template(os.path.basename(template_path))

Expand Down