Syspce | Sysmon Processes Correlation Engine

by lab52io Python Version: v1.1 License: GPL-3.0

X-Ray Key Features Code Snippets(3)Community Discussions Vulnerabilities Install Support

kandi X-RAY | Syspce Summary

Syspce is a Python library. Syspce has no bugs, it has no vulnerabilities, it has a Strong Copyleft License and it has low support. However Syspce build file is not available. You can download it from GitHub.

"sysmon processes correlation engine" (syspce) es un complemento de la herramienta de monitorización de entornos windows sysmon, capaz de añadir una capa de correlación a los eventos que esta genera. tiene como objetivo poder detetar actividades maliciosas, relacionando entre si las acciones atómicas identificadas por sysmon. por una parte, permite relacionar acciones que sucenden en la jerarquía de ejecución de los procesos, es decir, un proceso siempre cumple un relación de parentesco padre->hijo con su creador, por lo que se puede componer de forma general el "arbol genealógico" de los procesos de un sistema. esto es muy útil para detectar las acciones del malware mediante una estrategía de comportamiento y no de firmas. sysmon en su id 1 establece una relación de parentesco mínima padre/hijo, pero el correlador es capaz de trabajar en la detección de todo el arbol, relacionando

Support

Quality

Security

License

Reuse

Support

Syspce has a low active ecosystem.

It has 9 star(s) with 2 fork(s). There are 3 watchers for this library.

It had no major release in the last 12 months.

There are 6 open issues and 4 have been closed. On average issues are closed in 15 days. There are no pull requests.

It has a neutral sentiment in the developer community.

The latest version of Syspce is v1.1

Quality

Syspce has 0 bugs and 0 code smells.

Security

Syspce has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

Syspce code analysis shows 0 unresolved vulnerabilities.

There are 0 security hotspots that need review.

License

Syspce is licensed under the GPL-3.0 License. This license is Strong Copyleft.

Strong Copyleft licenses enforce sharing, and you can use them when creating open source projects.

Reuse

Syspce releases are available to install and integrate.

Syspce has no build file. You will be need to create the build yourself to build the component from source.

Installation instructions are not available. Examples and code snippets are available.

Top functions reviewed by kandi - BETA

kandi has reviewed Syspce and discovered the below as its top functions. This is intended to give you an instant insight into Syspce implemented functionality, and help decide if they suit your requirements.

Add event to process tree
Returns the live time of the job
Return a datetime
Returns a datetime
Preprocess events
Get the logon time of the process
Generate a unique syspce ID for a given image
Processes messages
Detect if src is in daemon mode
Detect a single source
Start filtering for events
Processes incoming messages
Initialize an input evtx
Read a memdump from src
Read an eventlog
This function is called when the node is running
Format a result baseline
Fire an alert
Send a message to the device
Start the engine
A helper method to convert a rule into a list
Start detection engine
Checks if the given action exists
Run method
Start the action

Get all kandi verified functions for this library.

Syspce Key Features

No Key Features are available at this moment for Syspce.

Syspce Examples and Code Snippets

Sysmon Processes Correlation Engine,Motores de correlación ️,Baseline Engine

Python

Lines of Code : 94

License : Strong Copyleft (GPL-3.0)

Copy

[{"explorer.exe":{"max_ttl": 1000000, "min_ttl": 20, "Points": 10,
    "1":{"Points": 100,
         "Image":{"Points": 75, "Value": "C:\\Windows\\explorer.exe"},
         "ParentImage":{"Points": 50, "Value": "EXPLORER_PARENT_IMAGE"},
         "-User

Sysmon Processes Correlation Engine,Motores de correlación ️,Process Hierarchy Engine

Python

Lines of Code : 83

License : Strong Copyleft (GPL-3.0)

Copy

Ej. System -> smss.exe -> wininit.exe -> Services.exe -> svchost.exe

'1','2', '3', '5','7','8','9','10','11','12','13','14','15', '17','18','22'

{"RuleID":9, "Rulename":"Successful phising attack", "Content": 
				[{'1':{'Image':'Outloo

Instalación

Python

Lines of Code : 48

License : Strong Copyleft (GPL-3.0)

Copy

pip install pywin32

O podemos instalarlo de la carpeta \Dependencies del propio repo

pip install pywin32-227-cp27-cp27m-win_amd64.whl

#registry_key.reg

#python sysmonCorrelator.py	

24/01/2020 11:12:09  [WARNING] Using default Sysmon config schem

Community Discussions

No Community Discussions are available at this moment for Syspce.Refer to stack overflow page for discussions.

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install Syspce

You can download it from GitHub.
You can use Syspce like any standard Python library. You will need to make sure that you have a development environment consisting of a Python distribution including header files, a compiler, pip, and git installed. Make sure that your pip, setuptools, and wheel are up to date. When using pip it is generally recommended to install packages in a virtual environment to avoid changes to the system.

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: