aa175a7d5b
wip
...
wip
2020-05-04 18:02:27 +01:00
dd9e128a15
kibana target update
...
kibana target now compatible with overrides
2020-05-04 17:35:12 +01:00
b3194e66c4
Update base.py
2020-05-04 16:37:36 +01:00
2b3828730c
Reversed disabling FileDelete
2020-05-02 17:31:50 +01:00
e5574e07f2
Disabled FileDelete event (Sysmon 11 - no rules available yet)
2020-05-02 16:21:56 +01:00
5abf4cbea9
Reordered fields
2020-05-02 14:46:55 +01:00
661108903b
Minor consistency fix
2020-05-02 14:37:37 +01:00
46737cbfd3
Improved Microsoft ATP mapping, using Advanced Hunting Schema
...
See https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference
2020-05-02 14:31:02 +01:00
98391f985a
wip
...
wip
2020-04-30 15:19:38 +01:00
9ce84a38e5
overrides section support + one example rule + cloudtrail config
...
ditto
2020-04-29 20:36:45 +01:00
7ac685882c
comments for usage
2020-04-11 15:47:23 +02:00
6312f381bf
C# backend
...
Converts Sigma rule into C# Regex in LINQ query
2020-04-10 16:12:05 +02:00
1c5c8047fd
Fixes
...
* Removed commented debug print statements
* Defined nullExpression
* Removed unneeded generateMapItemNode method
* Value cleaning bug on matching of wildcard at first character
2020-04-08 23:43:46 +02:00
cf896c3093
Merge branch 'master' of https://github.com/abhikhnvasara/sigma into pr-630
2020-04-08 23:16:39 +02:00
551a94af04
Merge branch 'master' of https://github.com/tileo/sigma into pr-658
2020-04-08 22:43:48 +02:00
7224af54b2
Merge pull request #664 from j91321/es-rule-options
...
es-rule backend options for index-patterns and time interval
2020-04-08 22:39:45 +02:00
1b7f33f5e2
Fixed undefined value in exception handling
...
Fixes issue #702 .
2020-04-08 22:28:47 +02:00
3470011ac3
Revert time interval, use index values provided by sigmaparser
2020-04-05 20:30:57 +02:00
693830fa83
Merge pull request 659
2020-04-03 23:46:53 +02:00
f92c5e9b18
Remove generation of LC rules with timeframe.
2020-04-02 15:25:30 -07:00
004eaf0615
Revert "do not escape u"
...
This reverts commit aa112cbd44
2020-03-24 23:36:12 +01:00
1025930e04
merge
2020-03-19 11:05:52 +07:00
2107d86900
merge
2020-03-19 10:58:30 +07:00
1b12a6b261
modified: tools/sigma/backends/carbonblack.py
2020-03-19 09:00:24 +07:00
aa112cbd44
do not escape u
2020-03-18 08:51:38 -04:00
17318b48bf
- fix agg_option keyword
...
- remove (now) unnecessary other hardcoded `.keyword` locations
2020-03-18 08:50:37 -04:00
e228d42b97
clean IP subnet
2020-03-18 16:49:44 +07:00
1df5620a14
fix cleanValue + leading wildcard + EventID Intergration
2020-03-18 16:02:44 +07:00
f0c83ae3b4
Added es-rule backend options
2020-03-15 13:03:20 +01:00
55bf39a2ac
keyword, analyzed field, case insensitivity
2020-03-11 11:38:56 -04:00
0947538228
MDATP schema changes
...
WDATP was renamed to MDATP (Microsoft Defendre ATP).
MDATP also had schema changes recently: https://techcommunity.microsoft.com/t5/microsoft-defender-atp/advanced-hunting-data-schema-changes/ba-p/1043914
The updates reflect these changes
2020-03-09 17:12:41 +01:00
9cb395823c
Rework according to review comments.
2020-03-04 14:54:49 -08:00
b070ffab74
Merge branch 'master' of https://github.com/Neo23x0/sigma
2020-03-03 10:08:31 +07:00
a0f7da8c03
Splunk XML backend rule title
...
Fixes #645
2020-03-01 22:23:35 +01:00
58f5fa1b8e
change to github
2020-02-28 16:56:48 +07:00
139600009b
conflict
2020-02-28 16:50:30 +07:00
5a2ccbd040
Fixed ArcSight backend visibility
2020-02-24 23:27:22 +01:00
d9b48ea747
Fixes in es-rule backend
2020-02-24 23:20:19 +01:00
5dc30bd388
Carbonblack, Arcsight ESM, Elastic Rule
2020-02-24 19:29:45 +02:00
516e61fdb0
t
2020-02-24 19:23:11 +02:00
612df1666b
add LOGIQ backend.
2020-02-22 20:50:30 -08:00
746f957a63
Merge branch 'patch-1' of https://github.com/fuseyjz/sigma into fuseyjz-patch-1
2020-02-21 22:24:44 +01:00
d0e9af171f
cleanIPRange
2020-02-06 17:20:52 +07:00
627f46abc2
backslash fix
2020-02-06 16:28:27 +07:00
bc4c6ce8db
cleanValue
2020-02-06 11:02:22 +07:00
579e7481c7
cleanValue + eventID list
2020-02-04 18:14:40 +07:00
1bc2c0b930
Deduplication of backend list
...
Fixes issue #609 . Added backend list debug output (class name).
2020-02-03 22:16:00 +01:00
2930df17d6
update sigma
2020-02-03 09:47:06 +07:00
dc5a31aebc
Updated Azure Sentinel backend
2020-01-31 17:17:24 +02:00
7b4ec734a8
Using rule ids as Kibana object id
2020-01-30 11:30:01 +01:00
pdr9rc