44ff9d154e
Increased test coverage for mapping corner cases
2018-10-16 14:53:12 +02:00
265ce115a0
Fixed conditional field mapping usage in mapping chains
2018-10-16 13:57:51 +02:00
a61b3d352a
Added test cases
...
* Generic log sources
* Splunk index queries
2018-10-15 15:24:18 +02:00
e28bc35cad
Apply field mappings in generation of log source condition
2018-10-06 23:38:35 +02:00
2fbf17ff34
Addition and resolution of field mapping chains explicitely checks for list
2018-09-13 16:22:29 +02:00
41a8ef2fd9
Implemented resolve_fieldname in FieldMappingChain
2018-09-13 14:56:31 +02:00
2330306db1
Added merged field mapping and log sources dict to config chain
2018-09-13 14:55:05 +02:00
ba76f04fe6
Merging of raw configurations in configuration chains
2018-09-13 13:49:36 +02:00
d81946df39
Stacked configurations
...
- Added log source rewriting
- Removed log source merging condition type setting
- Simplified SigmaLogsourceConfiguration constructor
- Condition is generated in SigmaParser instead of SigmaLogsourceConfiguration
Missing:
- Merging of raw config dict for backends that rely on this (es-dsl)
2018-09-12 23:40:22 +02:00
210f7ac044
Rewrote logsource definition merging to set generator
2018-09-12 22:29:51 +02:00
1d7722c1cb
Added configuration and field mapping chains
...
Missing: field name mapping of log source conditions.
2018-08-27 00:17:27 +02:00
320bb9f8c4
Added rewrite config to generic sysmon configuration
2018-08-14 21:34:54 +02:00
430972231f
Added generic sysmon configuration with process_execution config
2018-08-14 21:34:54 +02:00
2715c44173
Converted first Sysmon rule to generic process_execution rule
2018-08-14 21:34:54 +02:00
e0b3f91b2a
Removed empty line
2018-08-08 23:15:13 +02:00
f8246e9f49
Removed "not implemented" hints for available options in sigmac
2018-08-04 23:31:29 +02:00
0e986cae4d
Fixed log source and field names
2018-08-04 22:58:19 +02:00
e6c3313168
Merge branch 'master' of https://github.com/Neo23x0/sigma
2018-08-02 22:45:25 +02:00
af9f636199
Removal of backend output classes
...
Breaking change: Instead of feeding the output class with the results,
they are now returned as strings (*Backend.generate()) or list
(SigmaCollectionParser.generate()). Users of the library must now take
care of the output to the terminal, files or wherever Sigma rules should
be pushed to.
2018-08-02 22:41:32 +02:00
acfdb591d0
fiox: Typo in description fixed
2018-07-29 16:22:39 +02:00
1f845aa1d9
fix: Changed suspicious process creation rule to avoid FPs
2018-07-29 16:22:09 +02:00
1c9d0a176e
Moved const_start into class definition
2018-07-28 23:51:33 +02:00
8ceebba0d2
Merging split of config
2018-07-27 23:56:18 +02:00
df74460629
Fixed imports after config split
2018-07-27 23:54:18 +02:00
e02af9aa37
Merge config split branches
2018-07-27 23:16:50 +02:00
eb440b3357
Split config - code removal from configuration
2018-07-27 23:02:35 +02:00
36ada66007
Split config - Copy configuration
2018-07-27 23:01:41 +02:00
920c4b061d
Split config - code removal from filter
2018-07-27 22:35:30 +02:00
db07648f33
Merge pull request #133 from james0d0a/attack_tags
...
added a few mitre attack tags to windows sysmon rules
2018-07-27 07:55:56 +02:00
5fc118dcac
added a few mitre attack tags to windows sysmon rules
2018-07-26 21:15:07 -07:00
d235a9e017
Split config - Copy filter
2018-07-27 00:23:22 +02:00
50a6a92d20
Split config - code removal from exceptions
2018-07-27 00:17:35 +02:00
405bc4a0d1
Split config - Copy exception
2018-07-27 00:17:13 +02:00
096bc35447
Split config - code removal from mapping
2018-07-27 00:15:14 +02:00
4ffbb25960
Split config - Copy mapping
2018-07-27 00:13:19 +02:00
cad6e8d314
Merge parser split branch
2018-07-27 00:02:59 +02:00
1c4c67053c
Fixes for parser split
...
* Fixed imports
* Rename
2018-07-27 00:02:07 +02:00
88a4a5d36a
Merge parser split branches
2018-07-26 23:42:09 +02:00
595327ace4
Split parser - code removal from condition
2018-07-26 23:40:22 +02:00
c8043368bd
Split parser - code removal from rule
2018-07-26 22:43:49 +02:00
a9fcecab88
Merge pull request #130 from samsson/patch-4
...
Fixed typo / Created a rule
2018-07-26 22:34:46 +02:00
294ca20350
Split parser - code removal from collection
2018-07-26 22:28:33 +02:00
3a0de01bad
Split parser - code removal from base
2018-07-26 22:22:21 +02:00
b9425d13df
Split parser - code removal from exceptions
2018-07-26 22:18:21 +02:00
e550bf5c3b
Split parser - Copy base
2018-07-26 22:15:04 +02:00
a2329de03c
Split parser - Copy rule
2018-07-26 22:07:38 +02:00
016b15a2a9
Added quotation marks
...
I've added quotation marks to make it clearer (leading dash looks weird)
2018-07-26 18:10:21 +02:00
7796492c2b
Update powershell_NTFS_Alternate_Data_Streams
2018-07-26 08:54:08 -07:00
5e3211928f
Merge pull request #132 from dspautz/master
...
Add tags to APT rules
2018-07-25 09:57:35 +02:00
f039f95f4d
Add tags to APT rules
2018-07-25 09:50:01 +02:00
Thomas Patzke