0ee47e118c
Merge branch 'pr-848'
2020-06-28 01:04:30 +02:00
89ed9f3763
Merge pull request #819 from cclauss/patch-2
...
Undefined name: from .exceptions import SigmaCollectionParseError
2020-06-28 00:37:09 +02:00
09378b5ebf
Fixed unsupported attempt to index a set
2020-06-28 00:27:33 +02:00
415f826ece
Merge branch 'default-pop' of https://github.com/rtkbkish/sigma into rtkbkish-default-pop
2020-06-28 00:09:39 +02:00
b1e4f44c21
Merge pull request #823 from Kuermel/master
...
Add more Options for XPackWatcherBackend (Elasticsearch)
2020-06-28 00:03:04 +02:00
de5e453e19
Merge pull request #831 from 404d/cbr-backend-tweaks
...
Add parentheses around field list groups in CB
2020-06-27 23:39:57 +02:00
825bda397d
desc: better descriptions in help for backends and configurations
2020-06-25 13:21:43 +02:00
203aa192c7
Fix multiple references to default field mapping in same rule
...
If there is a default mapping specified for a fieldmapping and that field is
referenced multiple times in the rule, the default mapping will be "pop"ped
and return the unmapped key on subsequent uses.
Don't pop the value. Just return the first entry.
2020-06-18 13:01:31 -04:00
f907c49ab5
Improved test coverage
...
* Added test case
* Removed unused code
2020-06-13 01:11:08 +02:00
bbcbed4742
Add parentheses about field list groups in CB
...
This should address the grouping issue from #660 .
The grouping issue was solved by just slamming some parentheses around the fields in the listExpression field.
2020-06-11 15:33:02 +02:00
915ea1cc67
Merge branch 'script_entry_points' into master
2020-06-10 00:51:47 +02:00
8c61dc9248
Add more Options for XPackWatcherBackend (Elasticsearch)
...
Add action_throttle_period, mail_from adn mail_profile to the XPackWatcherBackend (Elasticsearch)
2020-06-09 20:57:26 +02:00
dff7efc173
Update collection.py
2020-06-08 13:55:52 +02:00
55c0a03564
Undefined name: from .exceptions import SigmaCollectionParseError
...
Discovered in #378 . `SigmaCollectionParseError()` is called on line 55 but it is never defined or imported which means that NameError will be raised instead of SigmaCollectionParseError.
2020-06-08 13:55:16 +02:00
36a7077648
Moved tool executables to new location
2020-06-07 01:14:04 +02:00
a7d18c7ed9
Converted sigma2attack and added to entry points
2020-06-07 01:03:09 +02:00
7d70cd95a4
Deduplicated backend list
2020-06-06 01:03:02 +02:00
fb9855bd3b
Added description to es-rule backend
2020-06-06 01:02:44 +02:00
c992dc5215
Improved test coverage
2020-06-05 23:33:51 +02:00
5d88d97c73
Merge branch 'improvements/improved_mdatp_mappings' of https://github.com/wietze/sigma into wietze-improvements/improved_mdatp_mappings
2020-06-05 23:03:52 +02:00
3a6ac5bd5c
Remove unused function
2020-05-30 01:57:06 +02:00
70935d26ce
Add license header
2020-05-29 23:56:05 +02:00
dedfb65d63
Implemented Aggregation for SQL, Added SQLite FullTextSearch
2020-05-25 11:58:55 +02:00
daf7ab5ff7
Cleanup: removal of corelight_* backends
2020-05-24 22:41:38 +02:00
d45f8e19fe
Fixes
2020-05-24 21:46:55 +02:00
32e4998c49
Removed dead code from ALA backend.
2020-05-24 21:45:37 +02:00
24b08bbf30
Merge branch 'master' of https://github.com/socprime/sigma into socprime-master
2020-05-24 17:06:32 +02:00
2893becf8c
Merge remote-tracking branch 'upstream/master'
2020-05-14 14:02:20 +01:00
37b08543ac
Updated author reference in license
2020-05-11 11:47:56 +02:00
fb9c5841f4
Added Humio, Crowdstrike, Corelight
2020-05-08 13:41:52 +03:00
dc96b7ffb3
Removed dependency on slugify
2020-05-08 11:40:16 +02:00
c5be83eb01
Added ee-outliers backend
2020-05-08 10:18:35 +02:00
24029a8f27
Fix for broken endswith modifier
2020-05-06 17:10:54 +02:00
aa175a7d5b
wip
...
wip
2020-05-04 18:02:27 +01:00
dd9e128a15
kibana target update
...
kibana target now compatible with overrides
2020-05-04 17:35:12 +01:00
b32093e734
Merge remote-tracking branch 'upstream/master'
...
Keeping up with the sigmas.
2020-05-04 17:26:51 +01:00
b3194e66c4
Update base.py
2020-05-04 16:37:36 +01:00
2b3828730c
Reversed disabling FileDelete
2020-05-02 17:31:50 +01:00
e5574e07f2
Disabled FileDelete event (Sysmon 11 - no rules available yet)
2020-05-02 16:21:56 +01:00
5abf4cbea9
Reordered fields
2020-05-02 14:46:55 +01:00
661108903b
Minor consistency fix
2020-05-02 14:37:37 +01:00
46737cbfd3
Improved Microsoft ATP mapping, using Advanced Hunting Schema
...
See https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference
2020-05-02 14:31:02 +01:00
2fafff3278
Fixed: escaping of backslashes before added *
...
Fixes issue #722 .
2020-05-02 00:13:15 +02:00
98391f985a
wip
...
wip
2020-04-30 15:19:38 +01:00
9ce84a38e5
overrides section support + one example rule + cloudtrail config
...
ditto
2020-04-29 20:36:45 +01:00
1c5c8047fd
Fixes
...
* Removed commented debug print statements
* Defined nullExpression
* Removed unneeded generateMapItemNode method
* Value cleaning bug on matching of wildcard at first character
2020-04-08 23:43:46 +02:00
cf896c3093
Merge branch 'master' of https://github.com/abhikhnvasara/sigma into pr-630
2020-04-08 23:16:39 +02:00
551a94af04
Merge branch 'master' of https://github.com/tileo/sigma into pr-658
2020-04-08 22:43:48 +02:00
7224af54b2
Merge pull request #664 from j91321/es-rule-options
...
es-rule backend options for index-patterns and time interval
2020-04-08 22:39:45 +02:00
1b7f33f5e2
Fixed undefined value in exception handling
...
Fixes issue #702 .
2020-04-08 22:28:47 +02:00
Thomas Patzke