Zircolite

Standalone and fast SIGMA-based detection tool that applies rule sets to Windows EVTX, Auditd, Sysmon for Linux, JSON and XML logs using an embedded SQLite engine. It outputs rule matches for threat hunting and incident response without requiring a SIEM.