be2ca8dc4d
Added checks for Sysmon 1 or EID 4688 instead of process_creation
2019-03-02 20:51:49 +03:00
c922f7d73f
Merge branch 'master' into project-1
2019-02-26 00:24:46 +01:00
ae62acf3d2
Added a test for duplicate filters and a test for Source: Eventlog
2019-02-18 21:05:58 +03:00
97b28f4308
Added a test for unnecessary use of '1 of them' in condition
2019-02-13 21:27:27 +03:00
cd2af196e3
Corrected path to rules
2019-01-25 12:25:51 +03:00
96220e776f
Added a test to check for duplicate filters in rules
2019-01-25 12:22:28 +03:00
3c7f46a6cd
Added rule test to CI testing
2019-01-23 23:31:36 +01:00
e3d61047bb
Added two tests. One for MITRE and another for file extension.
2019-01-22 21:25:13 +03:00
a9cf14438c
Merge branch 'master' into project-1
2019-01-14 22:36:15 +01:00
0e4842962b
Added tests
2018-11-04 22:16:20 +01:00
bd5b823725
Removed specific NetWintess config from test
2018-10-31 14:32:13 -05:00
26f73d60fa
Added NetWitness backend and tests
2018-10-31 14:07:59 -05:00
44ff9d154e
Increased test coverage for mapping corner cases
2018-10-16 14:53:12 +02:00
e411039b56
Fixed escaping of \u in Elasticsearch Query String queries
2018-05-01 00:05:16 +02:00
15a6c5efb5
Detailed error messages for failed queries
2018-04-12 00:20:54 +02:00
aeda30a389
Python rewrite of es-qs query test
2018-04-11 23:59:44 +02:00
788111f174
Fixes for Elasticsearch query correctness CI tests
...
* Quoting in rule
* Reading queries without special processing of backslashes
Unfortunately, backslashes still cause breaks caused by Bash handling of
them.
2018-04-09 22:33:29 +02:00
24d94d39b8
CI: Testing backend es-qs against Elasticsearch
2018-04-04 00:32:48 +02:00
d82a78fa3d
Finalizing PyPI release
...
* Removed .py suffix from command line tools
* sigmac tells when it does nothing and prints usage notice
* Makefile upload target
* minor changes
2017-12-08 23:50:08 +01:00
3b9ff57a38
Added merge_sigma tool
...
* Tests
* Restructured Makefile
2017-11-14 22:17:18 +01:00
e90ff2d991
Improved testing
...
* Added collection test case
* Test of file output
2017-11-01 21:14:11 +01:00
65e1f8ec2b
Increased test coverage
...
* more tests
* removed unneeded code
* increased coverage fail threshold
2017-10-23 23:30:44 +02:00
ec996e7353
Improved test coverage
2017-10-19 17:42:56 +02:00
Tareq AlKhatib