{"repo":"RasheedFarhat/DaC-Pipeline","free":true,"listed":false,"github":"https://github.com/RasheedFarhat/DaC-Pipeline","clone":"git clone https://github.com/RasheedFarhat/DaC-Pipeline.git","description":"Automated Detection-as-Code (DaC) CI/CD pipeline for validating and programmatically deploying SIEM detection rules via GitHub Actions and the Wazuh API","language":"Python","stars":12,"topics":["automation","ci-cd","detection-as-code","devsecops","python","siem","wazuh"],"license":"MIT","category":"deployment-docker-iac","readme_excerpt":"Detection-as-Code Pipeline · Sigma → Wazuh Write a threat detection once, in Sigma YAML. A custom compiler translates it into native Wazuh PCRE2 XML, CI validates it and pins its rule IDs, and CD deploys it to a live Wazuh manager. Every change goes through a pull request with tests and a deployment dry-run. Why this is more than a script: there is no official pysigma-backend-wazuh on PyPI, so scripts/compile sigma.py is a from-scratch compiler. It walks the Sigma detection AST and distributes it into disjunctive normal form, capped at 500 clauses ( MAX AND CLAUSE PRODUCT ) so a pathologically OR-heavy rule fails the build instead of hanging or exhausting memory. It applies De Morgan's law to negations, merges same-field literals into single PCRE2 patterns (lookahead conjunction for positives, alternation for negatives), emits (?i) to mirror Sigma's case-insensitive semantics, and resolves field names through field mappings.yaml . 87 unit tests cover it. For a stage-by-stage trace of one real rule — AST, DNF, De Morgan, the PCRE2 merge, and the honest scope limits — see docs/COMPILER.md . A companion tool, scripts/sigmahq coverage.py , measures how much of the upstream SigmaHQ ruleset this compiler already handles. See Importing from SigmaHQ below. 30-second tour make all compiles the current 58 Sigma rules (3 hand-authored + 55 imported from SigmaHQ) into 216 Wazuh rules, validates every ID and Sigma↔Wazuh UUID link, and runs the test suite. Some rules fan out to multiple Wa","default_branch":null,"files":null,"tree":[],"storefront":"/r/RasheedFarhat","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/RasheedFarhat/DaC-Pipeline/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}