droid is a PySigma wrapper allowing an easy adoption of Sigma and helps enabling Detection-As-Code. The ultimate goal of droid is to consume a repository Sigma rules and deploy them on one or multiple platform (SIEM/EDR). The tool also supports plain SIEM/EDR search queries.
Key features are:
- Validate the syntax of Sigma rules
- Convert them by applying a set of transforms per log source and platform
- Search in logs and report on findings
- Test the rules by leveraging Atomic Red Team™ (work in progress)
- Deploy them with any compatible SIEM and EDR (.e.g. Splunk, Microsoft Sentinel)
To get started with the tool, visit the documentation page and configure droid for your environment.
Note: Python version 3.11.8+ is required
Licensed under the EUPL.