Zircolite

venv

Runs Sigma rules directly against EVTX/JSON logs, no SIEM required.

Location

/opt/detectops/threat-hunting/zircolite

How to run

menu → 3, or:
source venv/bin/activate && python3 zircolite.py --evtx ./logs

---

Part of the Threat Hunting & Endpoint Analysis toolset in DetectOps.