Initial release: offline NetScaler triage with Sigma rules and MIT license

examples/rules.json

@@ -0,0 +1,17 @@
+{
+  "sources": [
+    {"id": "synthetic_example", "title": "Documentation examples, not threat intelligence"}
+  ],
+  "patterns": [
+    {
+      "id": "example_download_command",
+      "pattern": "(?i)\\b(?:curl|wget)\\s+https?://",
+      "description": "A download command appears in the log. Check its destination, arguments and execution evidence; legitimate administration can match.",
+      "source": "synthetic_example"
+    }
+  ],
+  "indicators": [
+    {"type": "ipv4", "value": "192.0.2.42", "status": "reference_only", "source": "synthetic_example"},
+    {"type": "domain", "value": "triage-demo.example.invalid", "status": "reference_only", "source": "synthetic_example"}
+  ]
+}

examples/rules.yml

@@ -0,0 +1,23 @@
+title: NetScaler Encoded Diagnostic Command In Request Context
+id: 34bd2f41-877e-4e16-91a5-4aeb62dddc21
+name: example_decoded_diagnostic_command
+status: experimental
+description: >-
+  Synthetic example matching a decoded identity command in an HTTP request.
+  A match does not prove execution and authorized diagnostics can match.
+author: NetScaler Triage contributors
+references:
+  - https://sigmahq.io/sigma-specification/specification/sigma-rules-specification.html
+logsource:
+  product: netscaler
+  service: http_access
+detection:
+  selection:
+    uri|startswith: /vpn/
+    raw|re: '^id$'
+  excluded:
+    uri|contains: /health
+  condition: selection and not excluded
+falsepositives:
+  - Authorized security tests and administrative diagnostics.
+level: low

examples/time.json

@@ -0,0 +1,5 @@
+{
+  "year": 2026,
+  "timezones": {"ADC-A": "UTC"},
+  "file_years": {"ADC-A/messages.previous": 2025}
+}