d371fd864c
Merge pull request #834 from ebeahan/elastic-updates
...
Elastic section updates
2020-06-13 10:04:49 +02:00
f907c49ab5
Improved test coverage
...
* Added test case
* Removed unused code
2020-06-13 01:11:08 +02:00
b129556388
Automatic inclusion of all configuration files
2020-06-13 00:04:45 +02:00
80e8f0e5fa
Release 0.17.0
2020-06-12 23:52:06 +02:00
24d83b80cd
Merge branch 'script_entry_points'
2020-06-12 23:13:11 +02:00
bba0b2d851
Elastic documentation improvements
2020-06-12 13:40:39 -05:00
aac1af1832
typo, was missing the = and *.
...
also, show option when using case insensitive for everything, how to "exclude" a field from that regex.
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com >
2020-06-12 11:37:32 -04:00
915ea1cc67
Merge branch 'script_entry_points' into master
2020-06-10 00:51:47 +02:00
565febd39d
README updated
2020-06-09 23:25:09 +02:00
f4fe425fa7
update readme for some analyzed field and keyword field examples
2020-06-09 16:53:50 -04:00
117ceac492
moved file to ecs-zeek-elastic-beats-implementation.yml
2020-06-09 08:56:01 -04:00
94b90adf10
docs: move Sigmac help from Wiki to repo
2020-06-07 12:18:37 +02:00
36a7077648
Moved tool executables to new location
2020-06-07 01:14:04 +02:00
a7d18c7ed9
Converted sigma2attack and added to entry points
2020-06-07 01:03:09 +02:00
8688e8a2a1
Script entrypoint stubs
2020-06-07 00:22:59 +02:00
7d70cd95a4
Deduplicated backend list
2020-06-06 01:03:02 +02:00
fb9855bd3b
Added description to es-rule backend
2020-06-06 01:02:44 +02:00
1d211565fc
Moved backend options list to --backend-help
2020-06-06 00:56:00 +02:00
c992dc5215
Improved test coverage
2020-06-05 23:33:51 +02:00
5d88d97c73
Merge branch 'improvements/improved_mdatp_mappings' of https://github.com/wietze/sigma into wietze-improvements/improved_mdatp_mappings
2020-06-05 23:03:52 +02:00
3a6ac5bd5c
Remove unused function
2020-05-30 01:57:06 +02:00
70935d26ce
Add license header
2020-05-29 23:56:05 +02:00
dedfb65d63
Implemented Aggregation for SQL, Added SQLite FullTextSearch
2020-05-25 11:58:55 +02:00
daf7ab5ff7
Cleanup: removal of corelight_* backends
2020-05-24 22:41:38 +02:00
d45f8e19fe
Fixes
2020-05-24 21:46:55 +02:00
32e4998c49
Removed dead code from ALA backend.
2020-05-24 21:45:37 +02:00
24b08bbf30
Merge branch 'master' of https://github.com/socprime/sigma into socprime-master
2020-05-24 17:06:32 +02:00
8d9b706d6a
Merge pull request #727 from 3CORESec/master
...
Override Features
2020-05-20 19:11:56 +02:00
e8b956f575
Updated config
2020-05-20 12:35:00 +03:00
9e272d37b7
zeek category update and minor field updates
2020-05-19 05:02:45 -04:00
177f0a783b
winlogbeat forward (at a snails pace) ECS field names
2020-05-19 04:58:51 -04:00
2893becf8c
Merge remote-tracking branch 'upstream/master'
2020-05-14 14:02:20 +01:00
37b08543ac
Updated author reference in license
2020-05-11 11:47:56 +02:00
fb9c5841f4
Added Humio, Crowdstrike, Corelight
2020-05-08 13:41:52 +03:00
dc96b7ffb3
Removed dependency on slugify
2020-05-08 11:40:16 +02:00
c5be83eb01
Added ee-outliers backend
2020-05-08 10:18:35 +02:00
3b96b5e497
Merge pull request #723 from neu5ron/socprime_add_zeek_and_corelight
...
sigmacs for Zeek and Corelight(Zeek)
2020-05-06 23:22:14 +02:00
24029a8f27
Fix for broken endswith modifier
2020-05-06 17:10:54 +02:00
31ad81874f
capitalized titles
...
corrected capitalization of titles and removed literals from config
2020-05-05 11:32:18 +01:00
aa175a7d5b
wip
...
wip
2020-05-04 18:02:27 +01:00
dd9e128a15
kibana target update
...
kibana target now compatible with overrides
2020-05-04 17:35:12 +01:00
b32093e734
Merge remote-tracking branch 'upstream/master'
...
Keeping up with the sigmas.
2020-05-04 17:26:51 +01:00
b3194e66c4
Update base.py
2020-05-04 16:37:36 +01:00
2b3828730c
Reversed disabling FileDelete
2020-05-02 17:31:50 +01:00
e5574e07f2
Disabled FileDelete event (Sysmon 11 - no rules available yet)
2020-05-02 16:21:56 +01:00
5abf4cbea9
Reordered fields
2020-05-02 14:46:55 +01:00
661108903b
Minor consistency fix
2020-05-02 14:37:37 +01:00
46737cbfd3
Improved Microsoft ATP mapping, using Advanced Hunting Schema
...
See https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference
2020-05-02 14:31:02 +01:00
cbe5af01a1
on behalf of @socprime [SOC Prime Inc.]( https://my.socprime.com/en/tdm/ )
...
add a total of 5 sigmac's (sigma configs) for 3 different backends. full git message to follow in PR.
2020-05-02 07:23:11 -04:00
2fafff3278
Fixed: escaping of backslashes before added *
...
Fixes issue #722 .
2020-05-02 00:13:15 +02:00
Florian Roth