Skip to content

Commit 3fb1a96

Browse files
authored
Merge pull request #2 from UncoderIO/Ginger-Headed-patch-1
Update README.md
2 parents 34963ef + 130236d commit 3fb1a96

File tree

1 file changed

+12
-12
lines changed

1 file changed

+12
-12
lines changed

README.md

+12-12
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
<img src="images/roota_logo_double.png" width="228" height="58">
33
</p>
44

5-
# An Open-Source Language for Collective Cyber Defence
5+
# An Open-Source Language for Collective Cyber Defense
66

7-
RootA is a public-domain language for collective cyber defense, created to make threat detection, incident response, and actor attribution simple. It acts as an open-source wrapper on top of most of the existing SIEM, EDR, XDR, and Data Lake query languages. If you learn the basics of RootA, you will be able to contribute to collective defense. And if you have mastered a specific SIEM language, with RootA and Uncoder.IO you can speak them all.
7+
RootA is a public-domain language for collective cyber defense, created to make threat detection, incident response, and actor attribution simple. It acts as an open-source wrapper on top of most of the existing SIEM, EDR, XDR, and Data Lake query languages. If you learn the basics of RootA, you will be able to contribute to collective defense. And if you have mastered a specific SIEM language, with RootA and Uncoder IO you can speak them all.
88

99
**Table Of Contents:**
1010

@@ -17,25 +17,25 @@ RootA is a public-domain language for collective cyber defense, created to make
1717
- [Resources & Useful Links](#book-resources--useful-links)
1818

1919
## :smiling_face_with_three_hearts: Why RootA
20-
The objective of RootA is to accelerate the global cyber industry collaboration. With RootA acting as a wrapper, cyber defenders can take a native rule or query and augment it with metadata to automatically translate the code into other SIEM, EDR, XDR, and Data Lake languages. Inspired by success of Yara and Sigma rules, RootA is focused on a broader applicability by a larger community of defenders.
20+
The objective of RootA is to accelerate the global cybersecurity industry collaboration. With RootA acting as a wrapper, cyber defenders can take a native rule or query and augment it with metadata to automatically translate the code into other SIEM, EDR, XDR, and Data Lake languages. Inspired by the success of Yara and Sigma rules, RootA is focused on a broader applicability by a larger community of defenders.
2121

22-
- RootA is expressed using **YAML**, a wide-spread, easy-to-write and human-readable format.
23-
- **Use any query language** for detection, Uncoder.IO will take care of the translation.
24-
- **Correlation support.** Common correlations are supported by RootA in order to make detection logic harder to bypass by the attackers, more compute efficient and future proof.
22+
- RootA is expressed using **YAML**, a widely spread, easy-to-write, human-readable format.
23+
- **Use any query language** for detection, Uncoder IO will take care of the translation.
24+
- **Correlation support.** Common correlations are supported by RootA in order to make detection logic harder to bypass by the attackers, more compute efficient, and future-proof.
2525
- **Log sources** can be explicitly or implicitly defined in the native query itself or in the customizable `logsource` field.
2626
- RootA syntax fully accommodates **OCSF** and **Sigma** as taxonomy, making it fast to learn, easy to read and share, and providing maximum compatibility for Detection Engineers.
27-
- **Threat Actor Timeline.** While Actors change, behaviours often stay the same. RootA supports an additional threat intelligence layer for CERTs, NCSCs, ISACs, MDRs, and Defence Agencies, to coordinate defence faster and with greater precision.
27+
- **Threat Actor Timeline.** While Actors change, behaviors often stay the same. RootA supports an additional threat intelligence layer for CERTs, NCSCs, ISACs, MDRs, and Defence Agencies, to coordinate defense faster and with greater precision.
2828
- **Mapping to TTPs.** Link detection logic to related tactics, techniques, and procedures in terms of MITRE ATT&CK®. Use custom tags to make the mapping even more tailored and detailed.
2929
- **Response as Code.** With enough community members and industry adoption, the next step after detection is sharing the code to automate response.
3030

3131
## :mage: Writing RootA Rules
3232
You can start writing RootA rules in any code editor that supports YAML.
33-
To translate RootA rules to other languages use Uncoder.IO by building it from source https://github.com/UncoderIO/UncoderIO or hosted online privately by SOC Prime since 2018 at https://uncoder.io
33+
To translate RootA rules to other languages use Uncoder IO by building it from the source https://github.com/UncoderIO/UncoderIO or hosted online privately by SOC Prime since 2018 at https://uncoder.io
3434

3535
### RootA Rule Templates
36-
RootA Rule format has minimal, full and extended templates.
36+
RootA Rule format has minimal, full, and extended templates.
3737

38-
**Minimal** template is for keeping rules simple, requiring only a name, description, author, severity, date, MITRE ATT&CK tags, detection query in any specific language, reference and license.
38+
**Minimal** template is for keeping rules simple, requiring only a name, description, author, severity, date, MITRE ATT&CK tags, detection query in any specific language, reference, and license.
3939

4040
**Full** template is for adding alerting context, threat actor campaign timeline, specific log source attributes defined based on Sigma Rules or AWS OCSF taxonomy, and cross-platform correlation section.
4141

@@ -134,6 +134,6 @@ The contents of this repo, along with RootA specifications, are in the public do
134134

135135
## :book: Resources & Useful Links
136136
- [RootA.IO](https://roota.io/) the main website page of the RootA project
137-
- [Uncoder.IO](https://github.com/UncoderIO/UncoderIO/) source code for translation engine Uncoder.IO which supports RootA, Sigma and IOC packaging into specific SIEM, EDR and Data Lake query formats
138-
- [Uncoder.IO](https://uncoder.io/) private hosted version of Uncoder.IO since 2018, operated by SOC Prime, does not track you, does not see your code
137+
- [Uncoder.IO](https://github.com/UncoderIO/UncoderIO/) source code for translation engine Uncoder IO which supports RootA, Sigma, and IOC packaging into specific SIEM, EDR, and Data Lake query formats
138+
- [Uncoder.IO](https://uncoder.io/) private hosted version of Uncoder IO since 2018, operated by SOC Prime, does not track you, does not see your code
139139
- [RootA Discord Channel](https://tdm.socprime.com/zeptolink/5IAokHui2iWUHaB8/) Discord channel to network with RootA enthusiasts

0 commit comments

Comments
 (0)