96e90fbff2
Fix recursion of rules
2020-11-06 12:43:52 +01:00
bf5d40eec3
New Backend - Kibana NDJSON
...
Tested against 7.9.3
2020-11-05 23:34:25 +01:00
f0e89b0c8c
Fixed: typecheck in sumologig-cse
2020-10-23 19:49:55 +02:00
2fb7dd5e99
Fixes
...
* Removed Splunk regex query
* Added test for sumologic-cse backend
2020-10-23 15:31:00 +02:00
383823f49a
Fix: added default value of current_table
2020-10-21 10:12:17 +03:00
f45e45d736
Fix: Import SigmaRegularExpressionModifier in the splunk backend.
2020-10-20 18:13:53 +03:00
51df5ad876
Added:
...
Sumo Logic CSE Rule Backend
Updated:
Mapping depence on logsource
Azure Sentinel Query Backend
MDATP: query with few logsources
CROWDSTRIKE: fix generateMapItemTypedNode
2020-10-06 15:07:52 +03:00
d3ee1aba66
docs: MITRE ATT&CK(R) trademark references removed or adjusted
...
https://github.com/Neo23x0/sigma/issues/1028
2020-09-30 08:53:52 +02:00
378d9c94cf
Merge branch 'master' of https://github.com/socprime/sigma into pr-981
2020-09-15 12:14:49 +02:00
5119f887c8
add Regular expression support
...
Add Regular expression support for netwitness-epl backend
2020-09-14 22:04:47 +02:00
531557465c
delete raise exception in case of sigma key is keyword(s)
2020-09-14 16:00:03 +02:00
09f25cf992
delete sqlparse module usage
2020-09-10 19:05:55 +02:00
e74846b767
modify comment
2020-09-10 18:09:15 +02:00
64035fd799
initial commit for Netwitness-EPL backend
2020-09-10 17:12:12 +02:00
a2fec9f3b9
Fix sysmon backend
2020-08-28 12:26:40 +03:00
f21b3c50c6
control whether to use an analyzed field or different type if a query/value contains a wildcard.
...
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com >
2020-08-25 13:13:18 -04:00
a7ffb96b6b
elasticsearch regex escape of '.' for case insensitivity backend options
...
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com >
2020-08-25 13:10:25 -04:00
76910eaee4
fix sub field name usage if there are 3 or more fields..
...
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com >
2020-08-25 12:56:57 -04:00
0d713e4544
control whether to use an analyzed field or different type if a query/value contains a wildcard.
...
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com >
2020-08-25 12:56:33 -04:00
1921e9dd89
Fix wild card and some escaped characters
2020-08-18 15:57:13 +07:00
d3ba1e4fb8
Add sysmon backend
2020-08-18 11:20:22 +03:00
01125ffd3b
Fixed: Elastalert backend handling of conditional field mappings
2020-08-11 23:29:18 +02:00
8352eefe22
STIX Support keywords (value without field)
2020-07-28 18:52:02 +03:00
32cf352236
Merge remote-tracking branch 'upstream/master'
2020-07-26 14:56:06 +03:00
dcb07bab2f
Merge pull request #949 from 0xballistics/powershell_backend_fix
...
partial(?) fix of #762
2020-07-25 10:18:05 +02:00
c329f6412d
Fix bug with NOT handling
2020-07-23 11:47:55 -04:00
6c7b4cf408
Revert additional change in base.py
2020-07-23 10:47:22 -04:00
ef9af3730a
Remove unnecessary edits from qradar.py
2020-07-23 10:34:29 -04:00
0e49a6acdf
Default NOT to false for all functions
2020-07-23 10:18:16 -04:00
0fac21f4a3
Remove modifications from base file and override in stix.py
2020-07-23 10:13:30 -04:00
30ff22776a
Fix NOT bug
2020-07-23 09:41:33 -04:00
875360f373
fixed wrong function call for elastalert aggregation. fixes #940
2020-07-20 14:32:30 +02:00
50ef79b398
Custom STIX object "x-sigma" for fields that missing mapping, so the pattern is STIX valid
2020-07-08 14:09:26 +03:00
9bcff522b6
Merge branch 'master' of https://github.com/rashimo/sigma into pr-709
2020-07-07 23:12:03 +02:00
acbab2db4b
stix backend + mapping configurations for windows logs and qradar
2020-07-07 15:04:16 +03:00
6ed1ea6509
Updating the mdatp backend file as it is currently impossible to set an ActionType as there is no mapping to EventType
2020-06-30 14:49:29 +01:00
b1e4f44c21
Merge pull request #823 from Kuermel/master
...
Add more Options for XPackWatcherBackend (Elasticsearch)
2020-06-28 00:03:04 +02:00
de5e453e19
Merge pull request #831 from 404d/cbr-backend-tweaks
...
Add parentheses around field list groups in CB
2020-06-27 23:39:57 +02:00
f907c49ab5
Improved test coverage
...
* Added test case
* Removed unused code
2020-06-13 01:11:08 +02:00
bbcbed4742
Add parentheses about field list groups in CB
...
This should address the grouping issue from #660 .
The grouping issue was solved by just slamming some parentheses around the fields in the listExpression field.
2020-06-11 15:33:02 +02:00
8c61dc9248
Add more Options for XPackWatcherBackend (Elasticsearch)
...
Add action_throttle_period, mail_from adn mail_profile to the XPackWatcherBackend (Elasticsearch)
2020-06-09 20:57:26 +02:00
fb9855bd3b
Added description to es-rule backend
2020-06-06 01:02:44 +02:00
c992dc5215
Improved test coverage
2020-06-05 23:33:51 +02:00
5d88d97c73
Merge branch 'improvements/improved_mdatp_mappings' of https://github.com/wietze/sigma into wietze-improvements/improved_mdatp_mappings
2020-06-05 23:03:52 +02:00
3a6ac5bd5c
Remove unused function
2020-05-30 01:57:06 +02:00
70935d26ce
Add license header
2020-05-29 23:56:05 +02:00
dedfb65d63
Implemented Aggregation for SQL, Added SQLite FullTextSearch
2020-05-25 11:58:55 +02:00
daf7ab5ff7
Cleanup: removal of corelight_* backends
2020-05-24 22:41:38 +02:00
d45f8e19fe
Fixes
2020-05-24 21:46:55 +02:00
32e4998c49
Removed dead code from ALA backend.
2020-05-24 21:45:37 +02:00
Hendrik