Zircolite

Uses magic bytes, content analysis, and regex fallback to identify log formats and timestamp fields automatically, minimizing manual configuration as described in the Key Features section.

Directly processes Sigma YAML rules with the pySigma backend, avoiding proprietary conversions and enabling use of standard detection rules without extra steps, as highlighted in the Native Sigma Support.

Supports custom Python transforms like Base64 decoding and hex-to-ASCII conversion for enriching log data, allowing analysts to decode obfuscated commands or extract IOCs, detailed in the Field Transforms examples.

Exports results to multiple formats including JSON, CSV, Splunk, and Elasticsearch using Jinja templates, providing seamless integration with various SIEMs and analysis tools.