# zargunlite

Zargunlite is a sigma rule detection engine based on sqlite.  

The core logic is inspired by [Zircolite](https://github.com/wagga40/Zircolite ) project and it is full compatible with plain sqlite queries or zircolite format rules generated by official [pySigma-backend-sqlite](https://github.com/SigmaHQ/pySigma-backend-sqlite ) .  

This project is implemented in pure Python, with strict type annotation, well packaging and basic test coverage, making it more suitable for integration into other projects as a library.  

## Description

Install [zargunlite](https://pypi.org/project/zargunlite/ ) from PyPI (requires `python>=3.10`):  
```
pip3 install zargunlite
```

See `tests/test_core.py` for some usage samples.  

Notice this project will continuously be in a very early state until version 1.0.0 release.  
Currently it is mainly for personal use because [Zircolite](https://github.com/wagga40/Zircolite ) does not have a PyPI package. There is also an [issue](https://github.com/wagga40/Zircolite/issues/87 ) raised by other user and fortunately the author is working on it.  
This project plans to add more features supported by [Zircolite](https://github.com/wagga40/Zircolite ) while keeps easy to be integrated as a library.  

## License

All the code is licensed under the [GNU Lesser General Public License](https://www.gnu.org/licenses/lgpl-3.0.en.html )
