security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,345 Commits 1 Branch 57 Tags
5f5b57504b645638835d3f83214668326ecb3426
Commit Graph

482 Commits

Author SHA1 Message Date
frack113 94bff8e5ea Merge pull request #2108 from hazedav/master 
fix(backend): add remediation for lacework policy
 2021-09-30 17:38:38 +02:00
hazedav 67818f125a fix(backend): add remediation for lacework policy 2021-09-30 09:27:18 -05:00
frack113 bcdf164b4c fix space 2021-09-27 19:17:14 +02:00
frack113 a0b48b96d4 Fix 'NoneType' object has no attribute 'lower' 2021-09-27 18:49:58 +02:00
Maxime Lamothe-Brassard 314fa5aaa5 Add validation for logical sub operators. 2021-09-14 18:00:09 -07:00
Thomas Patzke c7ecf6da65 Merge pull request #2009 from Preston-Young/master 
Added New OpenSearch Monitor Backend
 2021-09-13 23:07:35 +02:00
albchen 1dec1a49fa Mapped OriginalFileName in DeviceProcessEvents 
Mapped OriginalFileName to ProcessVersionInfoOriginalFileName in DeviceProcessEvents. Tested and works for rules such as https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_renamed_binary.yml
 2021-09-10 15:51:32 -07:00
Austin Songer a798469961 Update lacework.py 2021-09-10 09:46:57 -05:00
Young fe53f6dd5d moved default values to backend file 2021-09-09 15:02:59 -07:00
Young 647f81d128 reverted changes in base.py to upstream 2021-09-09 10:55:36 -07:00
Young 03a8d93a54 Merge branch 'master' of https://github.com/Preston-Young/sigma 2021-09-09 10:41:10 -07:00
Young c2c1b21a27 cleaning up changed files 2021-09-09 10:40:48 -07:00
Preston Young 4a98d68977 Merge branch 'SigmaHQ:master' into master 2021-09-09 10:28:16 -07:00
Thomas Patzke 51bc036dbf Merge pull request #1921 from roysjosh/azure-sentinel-arm-output 
Azure Sentinel support
 2021-09-01 22:26:42 +02:00
Thomas Patzke 3d6ad1bc0f Merge pull request #1944 from ncrqnt/elastic-subtechniques 
[Elastic] Add support for authors and subtechniques
 2021-09-01 22:25:10 +02:00
Young b0efaf5a51 changed adjustMatches function to combine aall atomic matches into a single bool statement 2021-08-31 18:15:46 -07:00
neu5ron 96c7e180fe Merge branch 'master' of https://github.com/SigmaHQ/sigma into qoutes_and_wildcards 
Signed-off-by: neu5ron <neu5ron@users.noreply.github.com>
 2021-08-30 16:33:33 -04:00
neu5ron 61897fa2e0 Merge branch 'master' of https://github.com/SigmaHQ/sigma into qoutes_and_wildcards 
Signed-off-by: neu5ron <neu5ron@users.noreply.github.com>
 2021-08-30 16:06:58 -04:00
Nico 00dec96245 Add support for subtechniques 2021-08-30 08:45:21 +02:00
Nico 5f271bf334 add author field to elastic rule 2021-08-30 08:29:07 +02:00
frack113 5f1143247b Update "sigmac -l" message 2021-08-28 08:51:58 +02:00
David Hazekamp cc6e4381b2 feat(backend): introducing lacework backend 
Adding authors
Removing todo
 2021-08-26 14:12:47 -05:00
David Hazekamp a5d175fbf7 feat(backend): introducing lacework backend 2021-08-26 14:05:44 -05:00
Joshua Roys 294bb432d0 Add Azure Sentinel backend 
The web interface expects ARM templates.
 2021-08-24 16:01:23 -04:00
Joshua Roys 829117ca7f Allow ints as values in ALA backend 
Without this, LogonType set as an int caused sigmac to abort the rule.
 2021-08-24 16:00:08 -04:00
Joshua Roys 93be8471ec Fix tactics/techniques in ALA backend 2021-08-24 15:58:21 -04:00
Young d1c7ee0830 cleaned up backend class and re-added support for threshold rules 2021-08-23 15:53:43 -07:00
Young f51c462439 finished building and translating AST, asupporting nested queries 2021-08-22 21:58:04 -07:00
Thomas Patzke 3396d72d81 Merge pull request #1887 from frack113/fix_NodeSubexpression_len 
fix sigmac error "has no len()"
 2021-08-22 12:11:16 +02:00
Thomas Patzke cbf1fd213b Merge pull request #1856 from theoguidoux/sql-sqlite-fields-selection 
[Ready] SQL & SQLite rule fields selection
 2021-08-22 12:09:07 +02:00
frack113 4e895da471 fix error "has no len()" 2021-08-20 09:20:56 +02:00
Young 6ccff2cff5 Added support for threshold rules 2021-08-18 18:15:18 -07:00
Austin Songer e039f91272 Spelling 2021-08-18 19:00:57 +00:00
Theo Guidoux 2a3acd7d11 add selection flag for backward compatibility 2021-08-16 19:32:54 +02:00
Theo Guidoux c1876b9ff6 add fields from rules to query + sqlite 2021-08-16 13:33:43 +02:00
Theo Guidoux 16269c0d63 cleaner default value handling 2021-08-16 10:47:05 +02:00
Theo Guidoux 40018eef7f edit help + case where 'select=' 2021-08-16 10:44:01 +02:00
Thomas Patzke 607724278a Merge pull request #1580 from codyswanson4:master 
Update Elasticsearch Watcher backend to populate name column in Kibana
 2021-08-13 23:33:47 +02:00
Thomas Patzke f9c9f73b09 Merge pull request #1772 from eocete-devo:master 
[Devo backend] Added support for multicondition rules using Devo subqueries
 2021-08-13 23:30:04 +02:00
Thomas Patzke 32400e5d55 Merge pull request #1785 from theoguidoux:theoguidoux/sql-backend-field-selection 
Add fields selection to sql backend option
 2021-08-13 23:29:24 +02:00
Thomas Patzke 62a53ca895 Merge pull request #1835 from wietze:fix/mdatp/linux_support 
Enabling Linux/macOS support on MDATP
 2021-08-13 23:28:06 +02:00
Young 900d149512 finished functionality for building flat queries 2021-08-13 00:42:26 -07:00
Young 3f37ee3964 created build query method 2021-08-12 22:40:45 -07:00
Thomas Patzke 1b215e3aaf Merge pull request #1828 from wietze/optimisation/nesting_reduction 
Optimising lists/subexpressions with only one item
 2021-08-12 22:41:17 +02:00
Thomas Patzke 8694afe023 Merge pull request #1779 from frack113/elastalert 
Fix elastalert multi output file
 2021-08-12 22:40:36 +02:00
Wietze 17595e2443 Enabling Linux/macOS support on MDATP, fixing incorrect parent cmd mappings 2021-08-12 18:07:13 +01:00
Wietze 7ba375dea0 Optimising lists/subexpressions with length 1 
Should reduce brackets on some output targets
 2021-08-11 18:00:09 +01:00
Young 13c868d3fd Added more helper functions and comments 2021-08-10 15:34:52 -07:00
Young 6474968615 added helper functions to clean up code 2021-08-09 14:42:17 -07:00
frack113 f6980edc66 fix english : normalize 2021-08-07 11:16:24 +02:00