You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The objective of RootA is to accelerate the global cyber industry collaboration. With RootA acting as a wrapper, cyber defenders can take a native rule or query and augment it with metadata to automatically translate the code into other SIEM, EDR, XDR, and Data Lake languages. Inspired by success of Yara and Sigma rules, RootA is focused on a broader applicability by a larger community of defenders.
22
19
23
20
- RootA is expressed using **YAML**, a wide-spread, easy-to-write and human-readable format.
@@ -29,7 +26,7 @@ The objective of RootA is to accelerate the global cyber industry collaboration.
29
26
-**Mapping to TTPs.** Link detection logic to related tactics, techniques, and procedures in terms of MITRE ATT&CK®. Use custom tags to make the mapping even more tailored and detailed.
30
27
-**Response as Code.** With enough community members and industry adoption, the next step after detection is sharing the code to automate response.
31
28
32
-
## Writing RootA Rules
29
+
## :mage:Writing RootA Rules
33
30
You can start writing RootA rules in any code editor that supports YAML.
34
31
To translate RootA rules to other languages use Uncoder.IO by building it from source https://github.com/UncoderIO/UncoderIO or hosted online privately by SOC Prime since 2018 at https://uncoder.io
[RootA specification](https://github.com/UncoderIO/RootA/blob/main/RootA_Specification.md) includes the list of all fields that can be used to write a RootA rule.
103
100
104
-
## How to Contribute
101
+
## :cookie:How to Contribute
105
102
Your contribution really matters in evolving the project and helping us make the RootA language even more useful for the global cyber defender community.
106
103
107
104
To submit your pull request with your ideas or suggestions for changes, take the following steps:
@@ -118,21 +115,20 @@ To submit your pull request with your ideas or suggestions for changes, take the
118
115
119
116
Thank you for your contribution to the RootA project!
We are genuinely grateful to security professionals who contribute their time, expertise, and creativity to evolve the RootA open-source project.
131
127
132
-
## Licenses
128
+
## :globe_with_meridians:Licenses
133
129
The contents of this repo, along with RootA specifications, are in the public domain.
134
130
135
-
## Resources & Useful Links
131
+
## :book:Resources & Useful Links
136
132
-[RootA.IO](https://roota.io/) the main website page of the RootA project
137
133
-[Uncoder.IO](https://github.com/UncoderIO/UncoderIO/) source code for translation engine Uncoder.IO which supports RootA, Sigma and IOC packaging into specific SIEM, EDR and Data Lake query formats
138
134
-[Uncoder.IO](https://uncoder.io/) private hosted version of Uncoder.IO since 2018, operated by SOC Prime, does not track you, does not see your code
0 commit comments