## What's Changed * patch streaming.py by @jkaspereit in https://github.com/wagga40/Zircolite/pull/130 ## New Contributors * @jkaspereit made their first contribution in https://github.com/wagga40/Zircolite/pull/130 **Full Changelog**: https://github.com/wagga40/Zircolite/compare/v3.6.1...v3.6.2

## What's new ### New features - **`--timesketch` shortcut** — Use the Timesketch export template and write to `timesketch-<RAND>.json` in one flag. Multiple exports no longer overwrite each other. - **ECS and Winlogbeat field mappings** — New mappings in `config/config.yaml` for Elastic Common Schema and Winlogbeat (channel, event ID, timestamps, etc.). Thanks to [@maspital](https://github.com/Maspital). - **Incremental result writing** — Parallel processing can write detection results incrementally - **Refined parallel worker calculation** — Improved choice of worker count ### Improvements - **`--keepflat`** — Behavior is now clearly defined: the flattened JSONL contains only events that were processed (events dropped by early event filtering or `--after`/`--before` are excluded). Combine with `--no-event-filter` to include all events. - **Early event filtering** — Documentation (Advanced.md, Usage.md) updated to explain when filtering is enabled, how Channel/EventID logic works, and how it interacts with keepflat and time range. - **Taskfile** — Cleanup task improvements. - **Rulesets** — Updated Linux and Windows rulesets and added rules for suspicious activities. **Full Changelog**: https://github.com/wagga40/Zircolite/compare/v3.2.0...v3.3.0

## What's New in v3.0.2 - Correct handling of order and priority of pipelines #110 Thanks to [@Maspital](https://github.com/Maspital) ## v3.0.0 changes : ### TL; DR; - Huge speed improvements - New transforms - New UI - Based on new pySigma backend ### Long version - Package refactor: Core logic split into zircolite package (core, streaming, flattener, rules, config_loader, console, parallel, etc.). - Event filter: Early skip by channel/EventID from rules before flattening. - Field transforms: Python transforms and alias fields in fieldMappings.yaml. - YAML-only field mappings: fieldMappings.json removed. - Rules v2: Zircolite-Rules-v2; dropped _full and _pysigma rulesets. - YAML run config: Full config via YAML (see config/zircolite_example.yaml). - Taskfile: Docker, rules update, cleanup tasks. - Rich console: Improved progress and logging. - Bug fix: Multiple rule files no longer produce invalid JSON (missing commas). - Docs and tests: Updated docs; new tests for event filter and transforms.

## What's New ### TL; DR; - Huge speed improvements - New transforms - New UI - Based on new pySigma backend ### Long version - Package refactor: Core logic split into zircolite package (core, streaming, flattener, rules, config_loader, console, parallel, etc.). - Event filter: Early skip by channel/EventID from rules before flattening. - Field transforms: Python transforms and alias fields in fieldMappings.yaml. - YAML-only field mappings: fieldMappings.json removed. - Rules v2: Zircolite-Rules-v2; dropped _full and _pysigma rulesets. - YAML run config: Full config via YAML (see config/zircolite_example.yaml). - Taskfile: Docker, rules update, cleanup tasks. - Rich console: Improved progress and logging. - Bug fix: Multiple rule files no longer produce invalid JSON (missing commas). - Docs and tests: Updated docs; new tests for event filter and transforms.

## What's Changed * Add [taskfile](https://taskfile.dev/) * Update Dockerfile * Update evtx_dump binaries * Remove forwarding (Splunk, ELK etc...) * Optimize speed * Update Detection Rule License link on README.md by @cridin1 in https://github.com/wagga40/Zircolite/pull/98 * Fix for invalid JSON output (variable scoping), when we specify multiple rule files, and have hits from multiple rule files. by @wmetcalf in https://github.com/wagga40/Zircolite/pull/100 ## New Contributors * @wmetcalf made their first contribution in https://github.com/wagga40/Zircolite/pull/100 **Full Changelog**: https://github.com/wagga40/Zircolite/compare/2.30.1...2.40.0

# v2.30.1 ## What's Changed * **Add field transforms** : Transforms in Zircolite are custom functions that manipulate the value of a specific field during the event flattening process. For example, you can decode base64 encoded values, extract credentials from logs etc. A quick demo is avaialable below. * **Zircolite is now up to 10% faster** * Dockerfile has been updated to automatically update rulesets * Docs have been updated > [!WARNING] > * Event forwarding to ELK, Splunk, etc. is **deprecated** > * Supported Python version is now **3.10** ## Field transforms demo https://github.com/user-attachments/assets/f21f3fcc-1ee4-4e4a-823f-a7d8ffcfd84d ## New Contributors * @nasbench made their first contribution in https://github.com/wagga40/Zircolite/pull/82

# v2.30.0 ## What's Changed * **Add field transforms** : Transforms in Zircolite are custom functions that manipulate the value of a specific field during the event flattening process. For example, you can decode base64 encoded values, extract credentials from logs etc. A quick demo is avaialable below. * **Zircolite is now up to 10% faster** * Dockerfile has been updated to automatically update rulesets * Docs have been updated > [!WARNING] > * Event forwarding to ELK, Splunk, etc. is **deprecated** > * Supported Python version is now **3.10** ## Field transforms demo https://github.com/user-attachments/assets/f21f3fcc-1ee4-4e4a-823f-a7d8ffcfd84d ## New Contributors * @nasbench made their first contribution in https://github.com/wagga40/Zircolite/pull/82 **Full Changelog**: https://github.com/wagga40/Zircolite/compare/2.20.0...2.30.0

# v2.20.0 ## What's Changed * Add **direct support for native Sigma rules with pySigma** 🥳 : `python3 zircolite.py -e samples.evtx -r schtasks.yml` * Add conditional imports to limit error for functionalities not used : requirements.txt / requirements.full.txt by @wagga40 in https://github.com/wagga40/Zircolite/pull/75 * Add option groups to improve help readability by @wagga40 in https://github.com/wagga40/Zircolite/pull/75 * Correct typo in docs by @wagga40 in https://github.com/wagga40/Zircolite/pull/75 * Add a simple mechanism to control external binaries by @wagga40 in https://github.com/wagga40/Zircolite/pull/75 * Update docs and rules by @wagga40 in https://github.com/wagga40/Zircolite/pull/75 * Update docs for pysigma and installation by @wagga40 in https://github.com/wagga40/Zircolite/pull/72 * [Snyk] Security upgrade aiohttp from 3.8.6 to 3.9.2 by @wagga40 in https://github.com/wagga40/Zircolite/pull/73 * [Snyk] Security upgrade orjson from 3.9.7 to 3.9.15 by @wagga40 in https://github.com/wagga40/Zircolite/pull/74 ### ⚠️ **Binary releases will be added later** (Sorry) **Full Changelog**: https://github.com/wagga40/Zircolite/compare/2.10.0...2.20.0