11982abec0
Add support for macOS rules and fix case sensitivity.
2021-04-28 16:49:59 -07:00
7c8cca744f
chore: Revert log file changes for THOR sigma configuration
...
Revert recent changes for Windows / Linux .log files for THOR
because of massive performance impacts.
2021-04-28 17:48:17 +02:00
de2cedf213
fix: Distinguish Windows and Linux logfiles by path separator
...
A previous commit added a log source detailing *.log files with
product: linux. This caused linux specific Sigma rules to apply to
all *.log file, including those on Windows. To distinguish these
cases, expand the file path pattern to include the typical start
for unix / windows paths ( / vs [A-Z]:\ )
2021-04-28 11:45:19 +02:00
d24f0b8988
feat: generic registry events compatible with native audit logging
2021-04-26 09:31:36 +02:00
66d0f910dd
feat: windows native events - registry_event
2021-04-25 22:35:23 +02:00
08234c4620
Revert "fix: splunk for windows config errors"
...
This reverts commit 13347df263
2021-04-25 21:52:29 +02:00
d766c12888
feat: generic categories - thor config
2021-04-23 17:47:09 +02:00
c7ce9154d1
Merge pull request #1030 from stevengoossensB/master
...
Updated sysmon config and rewrite rules to use categories
2021-04-23 16:52:25 +02:00
95fa99b4a3
search generic log files for product: linux
2021-04-23 12:00:48 +02:00
64f5af4c45
Merge pull request #1432 from SigmaHQ/rule-devel
...
fix: splunk windows config, additional rule
2021-04-23 10:30:44 +02:00
13347df263
fix: splunk for windows config errors
2021-04-23 09:50:13 +02:00
35e6e515ba
Merge pull request #1414 from herrBez/fix-542-dsl-aggregation-without-aggfield
...
Fix es-dsl aggregation generation when aggfield is not given
2021-04-20 10:35:16 +02:00
2ff27aa980
Fix SyntaxWarning for 'is' on fireeye-helix backend
2021-04-17 12:55:13 +02:00
7b679cc1f7
- Modified rules to use categories instead of hardcoded event IDs
...
- Added file_delete category (Sysmon Event ID 23) to the generic translation file
2021-04-15 01:40:31 +02:00
850a002840
Merge branch 'master' of https://github.com/SigmaHQ/sigma
2021-04-15 01:25:48 +02:00
3b30a91185
Fix es-dsl aggregation generation when aggfield is not given
...
Related to #542 and #543
2021-04-06 16:41:46 +02:00
5118be6bf6
Merge pull request #1407 from JohnConnorRF/winlogbeat_config_update
...
Update winlogbeat configuration file to support File Product details
2021-04-06 00:51:27 +02:00
82fd5ca233
Merge pull request #1408 from roysjosh/es-rule-threshold
...
Implement Elastic threshold detection rules
2021-04-06 00:50:50 +02:00
d789eb9c6f
Merge pull request #1409 from roysjosh/es-barf-on-multiple-conditions
...
Elastic: raise an error from the base backend if a rule has multiple conditions
2021-04-06 00:50:05 +02:00
9606fc9c38
Merge pull request #1411 from wietze/mdatp_improvements
...
Various Defender for Endpoint (mdatp) bug fixes
2021-04-06 00:37:40 +02:00
5f2ff99eea
Replaced pip requirements with pipenv
2021-04-03 01:00:22 +02:00
30c6d753fd
Removed unnecessary imports
2021-04-01 16:08:22 +01:00
fb1bb91c3c
Apply changes to Defender for Endpoint backend
2021-04-01 16:02:06 +01:00
477f05c5f2
Added in Product entry for winlogbeat-old
2021-04-01 09:24:24 -04:00
1f3ee87e55
Added Product field to winlogbeat-modules-enabled.config. Note that the ECS details for Process do not include Product ( https://www.elastic.co/guide/en/ecs/1.4/ecs-process.html ) so winlog.event_data.Product was used instead of process.Product
2021-04-01 09:19:21 -04:00
2560f40e06
Merge pull request #1406 from roysjosh/winlogbeat-mapping
...
Map CommandLine appropriately
2021-04-01 09:16:28 +02:00
7923852cc3
Elastic: raise an error from the base backend if a rule has multiple conditions
2021-03-31 16:01:05 -04:00
0448e46870
Implement Elastic threshold detection rules
...
Transform supported count() aggregations (> and >=, no count field,
optionally a group by field) into a threshold detection rule.
2021-03-31 15:19:04 -04:00
3fd396f4db
Updated winlogbeat configuration file to support File Product details
2021-03-30 13:21:14 -04:00
30ab2aad75
Map CommandLine appropriately
...
Args is an array of the exploded command line and causes many rules to misfire.
2021-03-30 10:15:10 -04:00
eb98f0ba28
Merge pull request #1402 from refractionPOINT/lc-support-live-wel
...
Add option to support different LimaCharlie targets.
2021-03-29 23:13:01 +02:00
ac1f82f7ca
Merge pull request #1380 from iosonogio/bugfix/netwitness-null
...
[bugfix] netwitness and netwitness-epl backends have incoherent null expressions
2021-03-29 11:23:18 +02:00
e0666036a4
Add option to support different LimaCharlie targets.
2021-03-24 17:58:50 -07:00
7d7dd4cb67
fix: missing index field in FE helix config
2021-03-20 09:09:45 +01:00
8b145e20e4
Merge branch 'rule-devel' of https://github.com/SigmaHQ/sigma into rule-devel
2021-03-20 09:04:40 +01:00
58a1ab9817
fix: wrong indentation in fireeye helix mapping
2021-03-20 09:04:38 +01:00
e47ee24889
Merge branch 'master' into rule-devel
2021-03-20 08:52:55 +01:00
9e287a1b89
feat: MSExchange Management log mapping
2021-03-20 08:49:59 +01:00
1fc408bfaa
fix: duplicate field values in YAML configs
2021-03-20 08:49:43 +01:00
6ac6b9295b
Merge pull request #1392 from hustlibraco/patch-1
...
Update winlogbeat.yml
2021-03-20 08:28:35 +01:00
42e82c95df
Updated for use with Image Load events
...
Added compatibility to add DeviceImageLoadEvents if "image_load" category is found. Also, field ImageLoaded added to the mapping.
2021-03-18 15:49:25 -07:00
6d626456f2
fix: syntax error in THOR's config file
2021-03-17 11:49:50 +01:00
3c5624ca88
Update winlogbeat.yml
...
add `SAMAccountName: winlog.event_data.SamAccountName` mapping for rules/windows/builtin/win_vul_cve_2020_1472.yml
2021-03-15 23:54:28 +08:00
2971a08734
Update winlogbeat.yml
...
add AccessList mapping of winlogbeat for rules/windows/builtin/win_susp_lsass_dump_generic.yml.
2021-03-15 23:01:07 +08:00
f4734cd5e5
Merge pull request #1309 from WuerthIT:logsourcemerging
...
functionality for parameter logsourcemerging
2021-03-13 22:25:29 +01:00
c13f3f1383
Merge pull request #1325 from dennispo/align-simac-stixshifter
...
sigmac to STIX enhancements
2021-03-13 18:49:12 +01:00
99c7889363
Merge pull request #1368 from roysjosh/stable-risk-scores
...
es-rule: make risk scores stable
2021-03-13 18:46:37 +01:00
7eeed68fb4
Chronicle Security Backend contributed by SOC Prime.
2021-03-12 12:21:44 +02:00
0873c57acf
Update netwitness.py
...
nullExpression fixed to be really null (missing exclamation mark)
2021-03-09 17:43:44 +01:00
4e5a9a58a5
Update netwitness-epl.py
...
nullExpression and notNullExpression fixed to be logically coherent and compatible with EPL syntax
2021-03-09 17:41:54 +01:00
Maxime Lamothe-Brassard