 Ben de Haan
|
dddb83393d
|
Added field mappings for events with logins
|
2017-03-30 10:49:36 +02:00 |
|
|
Ben de Haan
|
cb9a9bc2ff
|
Added LogPoint conditional username mapping
Conditional mapping of SubjectAccountName based on EventID. Not a comprehensive list, but should include most relevant Event IDs.
|
2017-03-30 09:51:32 +02:00 |
|
|
Thomas Patzke
|
c43166d5b9
|
Fixed log source configuration matching
|
2017-03-29 23:33:26 +02:00 |
|
|
Thomas Patzke
|
a22fe58ac9
|
Aggregation support for Splunk backend
|
2017-03-29 23:18:47 +02:00 |
|
|
Thomas Patzke
|
b62de742d7
|
Aggregation expression parsing
|
2017-03-29 23:17:43 +02:00 |
|
|
Thomas Patzke
|
ae5ae8f763
|
Verbose mode prints tokens if parsing failed
|
2017-03-29 22:21:40 +02:00 |
|
|
Thomas Patzke
|
9698e8fdf7
|
Changed Logpoint SubjectAccountName mapping to conditional mapping
|
2017-03-25 00:27:29 +01:00 |
|
|
Thomas Patzke
|
c978e19d88
|
Conditional field mappings
|
2017-03-25 00:21:44 +01:00 |
|
|
Thomas Patzke
|
a4465ce844
|
Added 1:n field mapping
MultiFieldMapping
|
2017-03-24 00:58:11 +01:00 |
|
|
Thomas Patzke
|
5009794591
|
Changes to field mappings
* Introduced field mapping objects
* moved mapping from backends into parse tree generation
(SigmaParser.parse_definition)
|
2017-03-24 00:48:32 +01:00 |
|
|
Florian Roth
|
7e180365ab
|
PowerShell Classic Log in Splunk Config Example
|
2017-03-22 11:17:46 +01:00 |
|
|
Ben de Haan
|
c3c405a95e
|
LogPoint windows mapping
|
2017-03-20 16:57:19 +01:00 |
|
|
Thomas Patzke
|
1bf11dc471
|
Merge pull request #17 from benno001/master
Fixed LogPoint list behaviour
|
2017-03-20 08:58:16 +01:00 |
|
|
Ben de Haan
|
c94b539b14
|
Fixed LogPoint list behaviour
|
2017-03-20 08:41:29 +01:00 |
|
|
Thomas Patzke
|
d0bed75eb9
|
Added --output/-o parameter to sigmac
|
2017-03-18 23:15:03 +01:00 |
|
|
Florian Roth
|
f34156138f
|
Bugfix - Index
|
2017-03-18 13:57:42 +01:00 |
|
|
Florian Roth
|
8403e8072c
|
Merge pull request #14 from benno001/master
Added LogPoint backend
|
2017-03-18 13:30:35 +01:00 |
|
|
Florian Roth
|
f292a259a5
|
Adjusted Windows Splunk Config
|
2017-03-18 13:12:31 +01:00 |
|
|
Ben de Haan
|
d18751a0ea
|
Added LogPoint backend
|
2017-03-18 11:12:06 +01:00 |
|
|
Thomas Patzke
|
17c484163d
|
Improved examples
|
2017-03-18 00:03:21 +01:00 |
|
|
Thomas Patzke
|
b4f52d9cfb
|
Windows index in Splunk example configuration
|
2017-03-17 23:30:11 +01:00 |
|
|
Thomas Patzke
|
b865a858aa
|
Generation of conditions for configured indices
|
2017-03-17 23:28:06 +01:00 |
|
|
Florian Roth
|
dc00baacda
|
Splunk Windows Configuration Example
|
2017-03-17 10:00:56 +01:00 |
|
|
Thomas Patzke
|
d2a9a91175
|
Log source conditions are integrated in generated expressions
Indices not yet included
|
2017-03-14 23:22:32 +01:00 |
|
|
Thomas Patzke
|
52d7e9fc07
|
Parsing log sources in configuration files
|
2017-03-12 23:12:21 +01:00 |
|
|
Thomas Patzke
|
12e825783b
|
Merge branch 'master' into devel-sigmac
|
2017-03-11 23:49:56 +01:00 |
|
|
Thomas Patzke
|
63e23af63c
|
Merge branch 'devel-sigmac-config' into devel-sigmac
|
2017-03-11 23:49:41 +01:00 |
|
|
Florian Roth
|
ad9f73a178
|
Merge branch 'devel-sigmac'
|
2017-03-07 10:49:03 +01:00 |
|
|
Florian Roth
|
b93379a6a9
|
Config example: sysmon / logstash index
|
2017-03-07 10:09:43 +01:00 |
|
|
Florian Roth
|
cd445f8ae9
|
Bugfix: non-recursive list not pathlib.Path elements but strings
|
2017-03-07 09:41:46 +01:00 |
|
|
Thomas Patzke
|
dae88fbcfa
|
Error and warning messages are printed to stderr
|
2017-03-06 23:01:33 +01:00 |
|
|
Thomas Patzke
|
d1030ec053
|
Fieldlist backend
Lists all fields used in given rules.
|
2017-03-06 22:47:30 +01:00 |
|
|
Thomas Patzke
|
05df298d45
|
Field mappings
|
2017-03-06 22:07:04 +01:00 |
|
|
Thomas Patzke
|
6ddc15c972
|
Merge branch 'devel-sigmac' into devel-sigmac-config
|
2017-03-06 21:32:58 +01:00 |
|
|
Thomas Patzke
|
896b8fb56e
|
Finished path recursion
|
2017-03-06 21:26:56 +01:00 |
|
|
Florian Roth
|
da6c5c19ae
|
Update README.md
|
2017-03-06 09:37:44 +01:00 |
|
|
Florian Roth
|
362ff157ba
|
Update README.md
|
2017-03-06 09:37:31 +01:00 |
|
|
Florian Roth
|
df39dee702
|
Sigmac recursive feature
|
2017-03-06 09:36:24 +01:00 |
|
|
Thomas Patzke
|
8864647e04
|
Parsing of sigmac configuration files
* field mappings
* log sources
|
2017-03-05 23:44:52 +01:00 |
|
|
Thomas Patzke
|
f092333bb4
|
Sigmac configuration parsing
|
2017-03-05 00:56:45 +01:00 |
|
|
Thomas Patzke
|
4aaa22fd6d
|
Made not implemented sigmac features obvious
* added notes to help message
* error if not implemented option is used
|
2017-03-04 23:36:46 +01:00 |
|
|
Florian Roth
|
47bfe82cc4
|
Splunk specifics
|
2017-03-04 10:37:40 +01:00 |
|
|
Florian Roth
|
9971192bff
|
Create README.md
|
2017-03-03 13:45:55 +01:00 |
|
|
Florian Roth
|
b984d83685
|
Typo in help text
|
2017-03-03 12:47:20 +01:00 |
|
|
Thomas Patzke
|
8f3541f0a0
|
Added Splunk backend
|
2017-03-02 23:34:12 +01:00 |
|
|
Thomas Patzke
|
2dd1c7cd12
|
Deactivated not implemented backends
|
2017-03-02 22:55:45 +01:00 |
|
|
Thomas Patzke
|
9556e73cd1
|
Fix: automatic escaping of * and ? in es-qs backend removed
|
2017-03-02 12:07:07 +01:00 |
|
|
Thomas Patzke
|
10ee9c64fe
|
Moved node output into dedicated backend class methods
|
2017-03-01 21:47:51 +01:00 |
|
|
Thomas Patzke
|
0d470af0e7
|
Set sigmac default backend to 'es-qs'
|
2017-03-01 09:40:51 +01:00 |
|
|
Thomas Patzke
|
e0f813ebbb
|
Conversion to Elasticsearch Query Strings
First version of sigmac that converts Sigma YAMLs without aggregations
into ES Query Strings suitable for Kibana or other tools.
|
2017-03-01 00:03:34 +01:00 |
|