Description
Triaging a possibly compromised Linux server means combing syslog, auditd and journald line by line. ChopChopGo rapidly hunts through Linux forensic artifacts with Sigma rules, surfacing suspicious events.
It's a single Go binary inspired by Chainsaw on Windows, with table, JSON and CSV output.
Sigma rules:Community detections.
Log sources:syslog, auditd and journald.
Single binary:Just run it.
Output:Table, JSON and CSV.
It's a single Go binary inspired by Chainsaw on Windows, with table, JSON and CSV output.
Features
Sigma rules:Community detections.
Log sources:syslog, auditd and journald.
Single binary:Just run it.
Output:Table, JSON and CSV.
