Skip to content

Commit 13aec9c

Browse files
Update README.md
1 parent 3fb1a96 commit 13aec9c

File tree

1 file changed

+27
-26
lines changed

1 file changed

+27
-26
lines changed

README.md

Lines changed: 27 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -3,45 +3,46 @@
33
</p>
44

55
# An Open-Source Language for Collective Cyber Defense
6+
:earth_americas: [Українська](README_Ukrainian.md)
67

7-
RootA is a public-domain language for collective cyber defense, created to make threat detection, incident response, and actor attribution simple. It acts as an open-source wrapper on top of most of the existing SIEM, EDR, XDR, and Data Lake query languages. If you learn the basics of RootA, you will be able to contribute to collective defense. And if you have mastered a specific SIEM language, with RootA and Uncoder IO you can speak them all.
8+
Roota is a public-domain language for collective cyber defense, created to make threat detection, incident response, and actor attribution simple. It acts as an open-source wrapper on top of most of the existing SIEM, EDR, XDR, and Data Lake query languages. If you learn the basics of Roota, you will be able to contribute to collective defense. And if you have mastered a specific SIEM language, with Roota and Uncoder IO you can speak them all.
89

910
**Table Of Contents:**
1011

11-
- [Why RootA](#smiling_face_with_three_hearts-why-roota)
12-
- [Writing RootA Rules](#mage-writing-roota-rules)
12+
- [Why Roota](#smiling_face_with_three_hearts-why-roota)
13+
- [Writing Roota Rules](#mage-writing-roota-rules)
1314
- [How to Contribute](#cookie-how-to-contribute)
1415
- [Maintainers](#smile_cat-maintainers)
1516
- [Credits](#clap-credits)
1617
- [Licenses](#globe_with_meridians-licenses)
1718
- [Resources & Useful Links](#book-resources--useful-links)
1819

19-
## :smiling_face_with_three_hearts: Why RootA
20-
The objective of RootA is to accelerate the global cybersecurity industry collaboration. With RootA acting as a wrapper, cyber defenders can take a native rule or query and augment it with metadata to automatically translate the code into other SIEM, EDR, XDR, and Data Lake languages. Inspired by the success of Yara and Sigma rules, RootA is focused on a broader applicability by a larger community of defenders.
20+
## :smiling_face_with_three_hearts: Why Roota
21+
The objective of Roota is to accelerate the global cybersecurity industry collaboration. With Roota acting as a wrapper, cyber defenders can take a native rule or query and augment it with metadata to automatically translate the code into other SIEM, EDR, XDR, and Data Lake languages. Inspired by the success of Yara and Sigma rules, Roota is focused on a broader applicability by a larger community of defenders.
2122

22-
- RootA is expressed using **YAML**, a widely spread, easy-to-write, human-readable format.
23+
- Roota is expressed using **YAML**, a widely spread, easy-to-write, human-readable format.
2324
- **Use any query language** for detection, Uncoder IO will take care of the translation.
24-
- **Correlation support.** Common correlations are supported by RootA in order to make detection logic harder to bypass by the attackers, more compute efficient, and future-proof.
25+
- **Correlation support.** Common correlations are supported by Roota in order to make detection logic harder to bypass by the attackers, more compute efficient, and future-proof.
2526
- **Log sources** can be explicitly or implicitly defined in the native query itself or in the customizable `logsource` field.
26-
- RootA syntax fully accommodates **OCSF** and **Sigma** as taxonomy, making it fast to learn, easy to read and share, and providing maximum compatibility for Detection Engineers.
27-
- **Threat Actor Timeline.** While Actors change, behaviors often stay the same. RootA supports an additional threat intelligence layer for CERTs, NCSCs, ISACs, MDRs, and Defence Agencies, to coordinate defense faster and with greater precision.
27+
- Roota syntax fully accommodates **OCSF** and **Sigma** as taxonomy, making it fast to learn, easy to read and share, and providing maximum compatibility for Detection Engineers.
28+
- **Threat Actor Timeline.** While Actors change, behaviors often stay the same. Roota supports an additional threat intelligence layer for CERTs, NCSCs, ISACs, MDRs, and Defence Agencies, to coordinate defense faster and with greater precision.
2829
- **Mapping to TTPs.** Link detection logic to related tactics, techniques, and procedures in terms of MITRE ATT&CK®. Use custom tags to make the mapping even more tailored and detailed.
2930
- **Response as Code.** With enough community members and industry adoption, the next step after detection is sharing the code to automate response.
3031

31-
## :mage: Writing RootA Rules
32-
You can start writing RootA rules in any code editor that supports YAML.
33-
To translate RootA rules to other languages use Uncoder IO by building it from the source https://github.com/UncoderIO/UncoderIO or hosted online privately by SOC Prime since 2018 at https://uncoder.io
32+
## :mage: Writing Roota Rules
33+
You can start writing Roota rules in any code editor that supports YAML.
34+
To translate Roota rules to other languages use Uncoder IO by building it from the source https://github.com/UncoderIO/UncoderIO or hosted online privately by SOC Prime since 2018 at https://uncoder.io
3435

35-
### RootA Rule Templates
36-
RootA Rule format has minimal, full, and extended templates.
36+
### Roota Rule Templates
37+
Roota Rule format has minimal, full, and extended templates.
3738

3839
**Minimal** template is for keeping rules simple, requiring only a name, description, author, severity, date, MITRE ATT&CK tags, detection query in any specific language, reference, and license.
3940

40-
**Full** template is for adding alerting context, threat actor campaign timeline, specific log source attributes defined based on Sigma Rules or AWS OCSF taxonomy, and cross-platform correlation section.
41+
**Full** template is for adding alerting context, threat actor campaign timeline, specific log source attributes defined based on Sigma Rules or OCSF taxonomy, and cross-platform correlation section.
4142

4243
**Extended** template is currently reserved for adding response as code and experimental features.
4344

44-
#### Minimal RootA rule example:
45+
#### Minimal Roota rule example:
4546
```
4647
name: Possible Credential Dumping Using Comsvcs.dll (via cmdline)
4748
details: Adversaries can use built-in library comsvcs.dll to dump credentials on a compromised host.
@@ -59,7 +60,7 @@ references:
5960
license: DRL 1.1
6061
```
6162

62-
#### Full RootA rule example:
63+
#### Full Roota rule example:
6364
```
6465
name: Possible Credential Dumping Using Comsvcs.dll (via cmdline)
6566
details: Adversaries can use built-in library comsvcs.dll to dump credentials on a compromised host.
@@ -100,14 +101,14 @@ correlation:
100101
```
101102

102103
### Fields
103-
[RootA specification](https://github.com/UncoderIO/RootA/blob/main/RootA_Specification.md) includes the list of all fields that can be used to write a RootA rule.
104+
[Roota specification](https://github.com/UncoderIO/RootA/blob/main/RootA_Specification.md) includes the list of all fields that can be used to write a Roota rule.
104105

105106
## :cookie: How to Contribute
106-
Your contribution really matters in evolving the project and helping us make the RootA language even more useful for the global cyber defender community.
107+
Your contribution really matters in evolving the project and helping us make the Roota language even more useful for the global cyber defender community.
107108

108109
To submit your pull request with your ideas or suggestions for changes, take the following steps:
109110

110-
1. Fork the [RootA repository](https://github.com/UncoderIO/RootA/tree/main) and clone your fork to your local environment.
111+
1. Fork the [Roota repository](https://github.com/UncoderIO/RootA/tree/main) and clone your fork to your local environment.
111112
2. Create a new feature branch in which you’re going to make your changes.
112113
3. Then commit your changes to your newly created feature branch.
113114
4. Push the changes to your fork.
@@ -117,7 +118,7 @@ To submit your pull request with your ideas or suggestions for changes, take the
117118
c. Provide a title and a description of your changes. Make sure they are both clear and informative.
118119
d. Finally, submit your Pull Request and wait for its approval.
119120

120-
Thank you for your contribution to the RootA project!
121+
Thank you for your contribution to the Roota project!
121122

122123
## :smile_cat: Maintainers
123124
- [Roman Ranskyi](https://www.linkedin.com/in/roman-966b91b5/)
@@ -127,13 +128,13 @@ Thank you for your contribution to the RootA project!
127128
- [Andrii Bezverkhyi](https://www.linkedin.com/in/andriimb/)
128129

129130
## :clap: Credits
130-
We are genuinely grateful to security professionals who contribute their time, expertise, and creativity to evolve the RootA open-source project.
131+
We are genuinely grateful to security professionals who contribute their time, expertise, and creativity to evolve the Roota open-source project.
131132

132133
## :globe_with_meridians: Licenses
133-
The contents of this repo, along with RootA specifications, are in the public domain.
134+
The contents of this repo, along with Roota specifications, are in the public domain.
134135

135136
## :book: Resources & Useful Links
136-
- [RootA.IO](https://roota.io/) the main website page of the RootA project
137-
- [Uncoder.IO](https://github.com/UncoderIO/UncoderIO/) source code for translation engine Uncoder IO which supports RootA, Sigma, and IOC packaging into specific SIEM, EDR, and Data Lake query formats
137+
- [Roota.IO](https://roota.io/) the main website page of the Roota project
138+
- [Uncoder.IO](https://github.com/UncoderIO/UncoderIO/) source code for translation engine Uncoder IO which supports Roota, Sigma, and IOC packaging into specific SIEM, EDR, and Data Lake query formats
138139
- [Uncoder.IO](https://uncoder.io/) private hosted version of Uncoder IO since 2018, operated by SOC Prime, does not track you, does not see your code
139-
- [RootA Discord Channel](https://tdm.socprime.com/zeptolink/5IAokHui2iWUHaB8/) Discord channel to network with RootA enthusiasts
140+
- [Roota Discord Channel](https://tdm.socprime.com/zeptolink/5IAokHui2iWUHaB8/) Discord channel to network with Roota enthusiasts

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy