Somewhere #DFIR
Wagga
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
wagga40