👽 Alien Parser

Alien Parser is a powerful CLI tool designed for DFIR analysts and threat hunters to extract YARA match results from THOR JSON logs and convert them into clean, filterable CSV files for enhanced analysis and reporting.

🚀 Features

• ✨ Extract YARA matches from THOR JSON logs
• 📊 Convert to CSV format for easy analysis in Excel/tools
• 🎯 Filter by score threshold to focus on high-priority matches
• 🔍 Filter by rule name for targeted investigation
• 📈 Generate summary reports with host statistics
• 🛡️ DFIR workflow optimized for incident response teams

🖥️ Command Line Interface

Clean, intuitive command-line interface with helpful examples

🛠️ Installation

1. Clone the repository:

   git clone https://github.com/mzalzahrani/Alien-parser.git
   cd Alien-parser

2. Requirements:

   • Python 3.7 or higher
   • Standard libraries only (json, csv, argparse)

📚 Usage

Basic Usage

python yaraconvert.py -i thor_log.json -o results.csv

Advanced Filtering

# Filter by minimum score
python yaraconvert.py -i thor_log.json -o high_priority.csv --min-score 80

# Filter by specific rule
python yaraconvert.py -i thor_log.json -o apt_matches.csv --rule-name "APT_Malware_Rule"

# Combine filters
python yaraconvert.py -i thor_log.json -o critical.csv --min-score 90 --rule-name "Critical_Rule"

Command Options

Option	Description	Example
-i, --input	Input THOR JSON log file	-i malware_scan.json
-o, --output	Output CSV file path	-o results.csv
--min-score	Minimum rule score (0-100)	--min-score 75
--rule-name	Filter by specific rule name	--rule-name "Backdoor_Detection"

📤 Output Files

CSV Report

Clean, structured CSV with columns:

• Temporal data: Timestamp, hostname, scan ID
• File information: Path, hash values, metadata
• YARA details: Rule name, score, matched data
• Context: File permissions, owner, creation time

JSON Summary

{
  "hosts_count": 15,
  "matches_count": 247,
  "alert_lines": 1834,
  "unique_hosts": ["workstation-01", "server-02", ...]
}

🎯 Use Cases

• Incident Response: Quickly analyze THOR scan results
• Threat Hunting: Filter and correlate YARA matches
• Malware Analysis: Extract IOCs from detection logs
• Compliance Reporting: Generate clean reports for stakeholders
• Security Operations: Integrate with SIEM/SOAR platforms

📋 Example Workflow

1. Run THOR scan on target systems
2. Collect JSON logs from multiple hosts
3. Process with Alien Parser to extract YARA matches
4. Import CSV into analysis tools (Excel, Splunk, etc.)
5. Investigate high-priority matches
6. Generate reports for incident documentation

🤝 Contributing

Contributions are welcome! Please feel free to submit pull requests, report bugs, or suggest enhancements.

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

👤 Author

Mohamed Alzahrani
*Cybersecurity Recearher

🔗 Connect with me:

• LinkedIn
• GitHub

---

⭐ If this tool helps your DFIR workflow, please give it a star!
🛡️ Happy Hunting!