You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+27-26Lines changed: 27 additions & 26 deletions
Original file line number
Diff line number
Diff line change
@@ -3,45 +3,46 @@
3
3
</p>
4
4
5
5
# An Open-Source Language for Collective Cyber Defense
6
+
:earth_americas:[Українська](README_Ukrainian.md)
6
7
7
-
RootA is a public-domain language for collective cyber defense, created to make threat detection, incident response, and actor attribution simple. It acts as an open-source wrapper on top of most of the existing SIEM, EDR, XDR, and Data Lake query languages. If you learn the basics of RootA, you will be able to contribute to collective defense. And if you have mastered a specific SIEM language, with RootA and Uncoder IO you can speak them all.
8
+
Roota is a public-domain language for collective cyber defense, created to make threat detection, incident response, and actor attribution simple. It acts as an open-source wrapper on top of most of the existing SIEM, EDR, XDR, and Data Lake query languages. If you learn the basics of Roota, you will be able to contribute to collective defense. And if you have mastered a specific SIEM language, with Roota and Uncoder IO you can speak them all.
The objective of RootA is to accelerate the global cybersecurity industry collaboration. With RootA acting as a wrapper, cyber defenders can take a native rule or query and augment it with metadata to automatically translate the code into other SIEM, EDR, XDR, and Data Lake languages. Inspired by the success of Yara and Sigma rules, RootA is focused on a broader applicability by a larger community of defenders.
20
+
## :smiling_face_with_three_hearts: Why Roota
21
+
The objective of Roota is to accelerate the global cybersecurity industry collaboration. With Roota acting as a wrapper, cyber defenders can take a native rule or query and augment it with metadata to automatically translate the code into other SIEM, EDR, XDR, and Data Lake languages. Inspired by the success of Yara and Sigma rules, Roota is focused on a broader applicability by a larger community of defenders.
21
22
22
-
-RootA is expressed using **YAML**, a widely spread, easy-to-write, human-readable format.
23
+
-Roota is expressed using **YAML**, a widely spread, easy-to-write, human-readable format.
23
24
-**Use any query language** for detection, Uncoder IO will take care of the translation.
24
-
-**Correlation support.** Common correlations are supported by RootA in order to make detection logic harder to bypass by the attackers, more compute efficient, and future-proof.
25
+
-**Correlation support.** Common correlations are supported by Roota in order to make detection logic harder to bypass by the attackers, more compute efficient, and future-proof.
25
26
-**Log sources** can be explicitly or implicitly defined in the native query itself or in the customizable `logsource` field.
26
-
-RootA syntax fully accommodates **OCSF** and **Sigma** as taxonomy, making it fast to learn, easy to read and share, and providing maximum compatibility for Detection Engineers.
27
-
-**Threat Actor Timeline.** While Actors change, behaviors often stay the same. RootA supports an additional threat intelligence layer for CERTs, NCSCs, ISACs, MDRs, and Defence Agencies, to coordinate defense faster and with greater precision.
27
+
-Roota syntax fully accommodates **OCSF** and **Sigma** as taxonomy, making it fast to learn, easy to read and share, and providing maximum compatibility for Detection Engineers.
28
+
-**Threat Actor Timeline.** While Actors change, behaviors often stay the same. Roota supports an additional threat intelligence layer for CERTs, NCSCs, ISACs, MDRs, and Defence Agencies, to coordinate defense faster and with greater precision.
28
29
-**Mapping to TTPs.** Link detection logic to related tactics, techniques, and procedures in terms of MITRE ATT&CK®. Use custom tags to make the mapping even more tailored and detailed.
29
30
-**Response as Code.** With enough community members and industry adoption, the next step after detection is sharing the code to automate response.
30
31
31
-
## :mage: Writing RootA Rules
32
-
You can start writing RootA rules in any code editor that supports YAML.
33
-
To translate RootA rules to other languages use Uncoder IO by building it from the source https://github.com/UncoderIO/UncoderIO or hosted online privately by SOC Prime since 2018 at https://uncoder.io
32
+
## :mage: Writing Roota Rules
33
+
You can start writing Roota rules in any code editor that supports YAML.
34
+
To translate Roota rules to other languages use Uncoder IO by building it from the source https://github.com/UncoderIO/UncoderIO or hosted online privately by SOC Prime since 2018 at https://uncoder.io
34
35
35
-
### RootA Rule Templates
36
-
RootA Rule format has minimal, full, and extended templates.
36
+
### Roota Rule Templates
37
+
Roota Rule format has minimal, full, and extended templates.
37
38
38
39
**Minimal** template is for keeping rules simple, requiring only a name, description, author, severity, date, MITRE ATT&CK tags, detection query in any specific language, reference, and license.
39
40
40
-
**Full** template is for adding alerting context, threat actor campaign timeline, specific log source attributes defined based on Sigma Rules or AWS OCSF taxonomy, and cross-platform correlation section.
41
+
**Full** template is for adding alerting context, threat actor campaign timeline, specific log source attributes defined based on Sigma Rules or OCSF taxonomy, and cross-platform correlation section.
41
42
42
43
**Extended** template is currently reserved for adding response as code and experimental features.
43
44
44
-
#### Minimal RootA rule example:
45
+
#### Minimal Roota rule example:
45
46
```
46
47
name: Possible Credential Dumping Using Comsvcs.dll (via cmdline)
47
48
details: Adversaries can use built-in library comsvcs.dll to dump credentials on a compromised host.
@@ -59,7 +60,7 @@ references:
59
60
license: DRL 1.1
60
61
```
61
62
62
-
#### Full RootA rule example:
63
+
#### Full Roota rule example:
63
64
```
64
65
name: Possible Credential Dumping Using Comsvcs.dll (via cmdline)
65
66
details: Adversaries can use built-in library comsvcs.dll to dump credentials on a compromised host.
@@ -100,14 +101,14 @@ correlation:
100
101
```
101
102
102
103
### Fields
103
-
[RootA specification](https://github.com/UncoderIO/RootA/blob/main/RootA_Specification.md) includes the list of all fields that can be used to write a RootA rule.
104
+
[Roota specification](https://github.com/UncoderIO/RootA/blob/main/RootA_Specification.md) includes the list of all fields that can be used to write a Roota rule.
104
105
105
106
## :cookie: How to Contribute
106
-
Your contribution really matters in evolving the project and helping us make the RootA language even more useful for the global cyber defender community.
107
+
Your contribution really matters in evolving the project and helping us make the Roota language even more useful for the global cyber defender community.
107
108
108
109
To submit your pull request with your ideas or suggestions for changes, take the following steps:
109
110
110
-
1. Fork the [RootA repository](https://github.com/UncoderIO/RootA/tree/main) and clone your fork to your local environment.
111
+
1. Fork the [Roota repository](https://github.com/UncoderIO/RootA/tree/main) and clone your fork to your local environment.
111
112
2. Create a new feature branch in which you’re going to make your changes.
112
113
3. Then commit your changes to your newly created feature branch.
113
114
4. Push the changes to your fork.
@@ -117,7 +118,7 @@ To submit your pull request with your ideas or suggestions for changes, take the
117
118
c. Provide a title and a description of your changes. Make sure they are both clear and informative.
118
119
d. Finally, submit your Pull Request and wait for its approval.
119
120
120
-
Thank you for your contribution to the RootA project!
121
+
Thank you for your contribution to the Roota project!
We are genuinely grateful to security professionals who contribute their time, expertise, and creativity to evolve the RootA open-source project.
131
+
We are genuinely grateful to security professionals who contribute their time, expertise, and creativity to evolve the Roota open-source project.
131
132
132
133
## :globe_with_meridians: Licenses
133
-
The contents of this repo, along with RootA specifications, are in the public domain.
134
+
The contents of this repo, along with Roota specifications, are in the public domain.
134
135
135
136
## :book: Resources & Useful Links
136
-
-[RootA.IO](https://roota.io/) the main website page of the RootA project
137
-
-[Uncoder.IO](https://github.com/UncoderIO/UncoderIO/) source code for translation engine Uncoder IO which supports RootA, Sigma, and IOC packaging into specific SIEM, EDR, and Data Lake query formats
137
+
-[Roota.IO](https://roota.io/) the main website page of the Roota project
138
+
-[Uncoder.IO](https://github.com/UncoderIO/UncoderIO/) source code for translation engine Uncoder IO which supports Roota, Sigma, and IOC packaging into specific SIEM, EDR, and Data Lake query formats
138
139
-[Uncoder.IO](https://uncoder.io/) private hosted version of Uncoder IO since 2018, operated by SOC Prime, does not track you, does not see your code
139
-
-[RootA Discord Channel](https://tdm.socprime.com/zeptolink/5IAokHui2iWUHaB8/) Discord channel to network with RootA enthusiasts
140
+
-[Roota Discord Channel](https://tdm.socprime.com/zeptolink/5IAokHui2iWUHaB8/) Discord channel to network with Roota enthusiasts
0 commit comments