Sysmon Python Packages

sigmatools

Main Sigma Rule Repository

netforensicai

Local-first, open-source DFIR investigation platform. Correlates pcap, JSON/CSV and Windows EVTX/Sysmon evidence into one traceable timeline, entity graph and evidence-cited findings - with offline detection rules, MITRE ATT&CK mapping, a local web UI, live capture, and an optional AI assistant that cannot fabricate citations.

eis-sigmatools

Main Sigma Rule Repository

sysmon2df

Captures Sysmon events and converts the output into a pandas DataFrames / CSV

sysxtract

Extract logs based off events from sysmon. Comes as a package, cli and ui.