Initial release: offline NetScaler triage with Sigma rules and MIT license

examples/rules.json

@@ -0,0 +1,17 @@
+{
+  "sources": [
+    {"id": "synthetic_example", "title": "Documentation examples, not threat intelligence"}
+  ],
+  "patterns": [
+    {
+      "id": "example_download_command",
+      "pattern": "(?i)\\b(?:curl|wget)\\s+https?://",
+      "description": "A download command appears in the log. Check its destination, arguments and execution evidence; legitimate administration can match.",
+      "source": "synthetic_example"
+    }
+  ],
+  "indicators": [
+    {"type": "ipv4", "value": "192.0.2.42", "status": "reference_only", "source": "synthetic_example"},
+    {"type": "domain", "value": "triage-demo.example.invalid", "status": "reference_only", "source": "synthetic_example"}
+  ]
+}