Hugging Face's logo

alirezaaminzadeh
/
sigmaforge-logsource-classifier

Scikit-learn
Joblib
English
tfidf_logistic_logsource_classifier
cybersecurity
sigma
detection-engineering
mitre-attack
gradio
enterprise
Model card Files
xet
 Community
alirezaaminzadeh commited on
Commit
0f5b01d
·
verified ·
1 Parent(s): 287a87d

Upload logsource classifier

Browse files
Files changed (11) hide show
  1. .gitattributes +1 -0
  2. README.md +32 -0
  3. classifier_config.json +80 -0
  4. config.json +8 -0
  5. embedding_model.txt +1 -0
  6. faiss.index +3 -0
  7. logsource_classifier.joblib +3 -0
  8. retriever_vectorizer.joblib +3 -0
  9. rule_embeddings.npy +3 -0
  10. tfidf_vectorizer.joblib +3 -0
  11. train_metrics.json +5 -0
.gitattributes CHANGED
@@ -33,3 +33,4 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
33
  *.zip filter=lfs diff=lfs merge=lfs -text
34
  *.zst filter=lfs diff=lfs merge=lfs -text
35
  *tfevents* filter=lfs diff=lfs merge=lfs -text
 
 
33
  *.zip filter=lfs diff=lfs merge=lfs -text
34
  *.zst filter=lfs diff=lfs merge=lfs -text
35
  *tfevents* filter=lfs diff=lfs merge=lfs -text
36
+ faiss.index filter=lfs diff=lfs merge=lfs -text
README.md ADDED
@@ -0,0 +1,32 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ ---
2
+ license: mit
3
+ language:
4
+ - en
5
+ tags:
6
+ - cybersecurity
7
+ - sigma
8
+ - detection-engineering
9
+ - mitre-attack
10
+ - gradio
11
+ - enterprise
12
+ library_name: sklearn
13
+ ---
14
+
15
+ # SigmaForge Logsource Classifier
16
+
17
+ TF-IDF + Logistic Regression classifier that maps detection hypotheses to Sigma `logsource` fields (product, service, category).
18
+
19
+ ## Intended Use
20
+
21
+ - Classify log source for Sigma rule generation pipeline
22
+ - Not for production SIEM routing without retraining on your environment
23
+
24
+ ## Training
25
+
26
+ Trained on synthetic hypothesis ↔ logsource pairs derived from SigmaHQ rule corpus.
27
+
28
+ ## Limitations
29
+
30
+ - CPU-only inference
31
+ - Best performance on Windows/Sysmon/DNS hypotheses
32
+ - Heuristic fallback when model artifacts unavailable
classifier_config.json ADDED
@@ -0,0 +1,80 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ {
2
+ "idx_to_label": {
3
+ "0": "aws|cloudtrail",
4
+ "1": "azure|activitylogs",
5
+ "2": "azure|auditlogs",
6
+ "3": "azure|pim",
7
+ "4": "azure|riskdetection",
8
+ "5": "azure|signinlogs",
9
+ "6": "bitbucket|audit",
10
+ "7": "cisco|duo",
11
+ "8": "gcp|gcp.audit",
12
+ "9": "gcp|google_workspace.admin",
13
+ "10": "gcp|google_workspace.login",
14
+ "11": "github|audit",
15
+ "12": "jvm",
16
+ "13": "kubernetes|audit",
17
+ "14": "linux",
18
+ "15": "linux|auditd",
19
+ "16": "linux|clamav",
20
+ "17": "linux|guacamole",
21
+ "18": "linux|sshd",
22
+ "19": "linux|syslog",
23
+ "20": "linux|vsftpd",
24
+ "21": "m365|audit",
25
+ "22": "m365|exchange",
26
+ "23": "m365|threat_management",
27
+ "24": "nodejs",
28
+ "25": "okta|okta",
29
+ "26": "onelogin|onelogin.events",
30
+ "27": "opencanary",
31
+ "28": "python",
32
+ "29": "rpc_firewall",
33
+ "30": "ruby_on_rails",
34
+ "31": "spring",
35
+ "32": "sql",
36
+ "33": "velocity",
37
+ "34": "windows",
38
+ "35": "windows|security",
39
+ "36": "windows|sysmon"
40
+ },
41
+ "labels": [
42
+ "aws|cloudtrail",
43
+ "azure|activitylogs",
44
+ "azure|auditlogs",
45
+ "azure|pim",
46
+ "azure|riskdetection",
47
+ "azure|signinlogs",
48
+ "bitbucket|audit",
49
+ "cisco|duo",
50
+ "gcp|gcp.audit",
51
+ "gcp|google_workspace.admin",
52
+ "gcp|google_workspace.login",
53
+ "github|audit",
54
+ "jvm",
55
+ "kubernetes|audit",
56
+ "linux",
57
+ "linux|auditd",
58
+ "linux|clamav",
59
+ "linux|guacamole",
60
+ "linux|sshd",
61
+ "linux|syslog",
62
+ "linux|vsftpd",
63
+ "m365|audit",
64
+ "m365|exchange",
65
+ "m365|threat_management",
66
+ "nodejs",
67
+ "okta|okta",
68
+ "onelogin|onelogin.events",
69
+ "opencanary",
70
+ "python",
71
+ "rpc_firewall",
72
+ "ruby_on_rails",
73
+ "spring",
74
+ "sql",
75
+ "velocity",
76
+ "windows",
77
+ "windows|security",
78
+ "windows|sysmon"
79
+ ]
80
+ }
config.json ADDED
@@ -0,0 +1,8 @@
 
 
 
 
 
 
 
 
 
1
+ {
2
+ "engine_version": "1.0.0",
3
+ "model_type": "tfidf_logistic_logsource_classifier",
4
+ "embedding_model": "sentence-transformers/all-MiniLM-L6-v2",
5
+ "train_samples": 406,
6
+ "labels": 37,
7
+ "accuracy": 0.9631
8
+ }
embedding_model.txt ADDED
@@ -0,0 +1 @@
 
 
1
+ sentence-transformers/all-MiniLM-L6-v2
faiss.index ADDED
@@ -0,0 +1,3 @@
 
 
 
 
1
+ version https://git-lfs.github.com/spec/v1
2
+ oid sha256:cee2c87d9a03103a5b2ba53f8b399c11727f218798c9583c239b496968d0be46
3
+ size 780333
logsource_classifier.joblib ADDED
@@ -0,0 +1,3 @@
 
 
 
 
1
+ version https://git-lfs.github.com/spec/v1
2
+ oid sha256:4f620eb1c1c5fb5c6dcf39bc7321aa3adeea87d6d27737f36cabb6e182ca8b2e
3
+ size 607560
retriever_vectorizer.joblib ADDED
@@ -0,0 +1,3 @@
 
 
 
 
1
+ version https://git-lfs.github.com/spec/v1
2
+ oid sha256:c47cebcd7b4377ed24dd0f8d6c004a28d1cac0086ed51bc5f619e03e88045e1f
3
+ size 14113
rule_embeddings.npy ADDED
@@ -0,0 +1,3 @@
 
 
 
 
1
+ version https://git-lfs.github.com/spec/v1
2
+ oid sha256:38cb32f65a5bb0fc0ca8349566c57c8da50e0203bfc4ea91ddaa32375b22bafd
3
+ size 780416
tfidf_vectorizer.joblib ADDED
@@ -0,0 +1,3 @@
 
 
 
 
1
+ version https://git-lfs.github.com/spec/v1
2
+ oid sha256:65714e0bbefe137e995363ef9f7b150592bf43cfe02ec14f6dc4e43b88dc29d9
3
+ size 77072
train_metrics.json ADDED
@@ -0,0 +1,5 @@
 
 
 
 
 
 
1
+ {
2
+ "train_samples": 406,
3
+ "labels": 37,
4
+ "accuracy": 0.9631
5
+ }