Zircolite in pypi

[kenleejl]

Can you upload zircolite to pypi? Zircolite-dev would be useful!

[wagga40]

Yes, I could, it is a great idea.
It will require me some work to package for PyPI so don’t expect it tomorrow but I’ll work on it.

[kenleejl]

Thanks! looking forward to the PyPI package!

[kenleejl]

@wagga40 Hi any updates?

[wagga40]

Hi,

Zircolite is available on pypi here.

I am not happy with the package right now, I have to work on it but it works.

Since it is a Pypi release, it is missing :

• config/mappings file, you will have to provide it (default one is here : https://github.com/wagga40/Zircolite/blob/master/config/fieldMappings.json)
• rulesets will have to be generated or taken from here
• package (Gui) file so "--package" will not work as is (you have to recreate "gui/zircogui.zip" in the working directory)

Therefore, the command line is :

zircolite -e /Users/wagga/Desktop/samples.evtx -r rules_windows_sysmon_full.json -c fieldMappings.json