c848c473a3
Error when empty fields attribute
2018-11-23 15:37:42 +01:00
31eae25756
Indentation error
2018-11-23 15:20:17 +01:00
e43909678e
Added the fields attribute parser
...
Make a table with the fields present in the fields attribute
2018-11-23 15:11:12 +01:00
c2eb87133d
Distinct count in aggragation function
...
Added dc() instead of count() when group-by field is present. Because count() doesn't do a distinct count in Splunk. Must be the dc() function instead.
2018-11-23 15:04:08 +01:00
aa1a953a65
Moved node dumping code to generic location
2018-11-21 23:22:38 +01:00
26d888aec3
Removed "not null" handling code
...
Feature was removed some time ago.
2018-11-21 22:56:48 +01:00
9e28669c33
Backend es-qs return quotes on empty or whitespace-only string
2018-11-21 22:29:12 +01:00
49d464f979
Fixed wildcards in es-qs backend
2018-11-20 23:23:54 +01:00
396a030ed1
Removed duplicate code
2018-11-07 22:52:12 +01:00
116a0e9f03
Merge branch 'master' of https://github.com/tuckner/sigma into tuckner-master
2018-11-07 22:27:41 +01:00
5053cc4e95
Fixed optimizing of not conditions with subexpressions
...
Optimization pass traversal is cut at ConditionNOT nodes.
2018-11-07 13:54:45 +01:00
a88b1e81ec
Optimizer debugging code cleanup
...
* Removed commented debugging code
* Output to stdin
* Coverage exception for _dumpNode
2018-11-07 13:49:08 +01:00
42ed8acec9
Improved test coverage
...
* Adding tests
* Removal of coverage measurement for debugging code
2018-11-04 23:28:40 +01:00
418f8d10a3
Wrap conditions generated by mappings into sub-expression
2018-11-04 23:00:04 +01:00
0e4842962b
Added tests
2018-11-04 22:16:20 +01:00
ca6ba4a85b
Added NetWitness backend and tests
2018-10-31 14:24:14 -05:00
26f73d60fa
Added NetWitness backend and tests
2018-10-31 14:07:59 -05:00
eacfaa7460
Check for forbidden null values in list items in Splunk backend
2018-10-27 01:07:03 +02:00
0cc8b77307
Merge branch 'master' of https://github.com/pivotforensics/sigma into pivotforensics-master
2018-10-18 15:56:26 +02:00
e501c4a5b9
Added additional output type 'json' to the xpack-watcher backend which prints each watcher as compress json, one watcher per line
2018-10-17 10:38:56 +02:00
265ce115a0
Fixed conditional field mapping usage in mapping chains
2018-10-16 13:57:51 +02:00
5b33713ef8
Quick fix for string formatting bug
2018-10-13 20:21:37 -05:00
38ec257f7e
Re-doing LogName formatting
2018-10-13 20:18:57 -05:00
9f48265eb1
Adding re.sub for LogName that accounts for expression grouping
2018-10-13 20:09:54 -05:00
aabaa0257b
Merge branch 'master' of https://github.com/Neo23x0/sigma
2018-10-06 20:12:15 -05:00
4b85a34b34
Added CSV option to powershell backend
2018-10-06 20:08:20 -05:00
e28bc35cad
Apply field mappings in generation of log source condition
2018-10-06 23:38:35 +02:00
fc45df144c
Improve the comments on the optimizer
2018-10-03 13:44:03 +02:00
87aa1b5521
Move optimizer to sigma.parser.condition to enable it for all backends
2018-10-03 00:24:31 +02:00
cd3661b60c
Fix optimization of NOT corner cases
2018-10-02 22:48:33 +02:00
bed88cf813
Make uniq work for lists within definitions
2018-10-02 22:12:54 +02:00
7165128fa5
Remove None from AST - fixes None-related test failures
2018-10-02 21:44:37 +02:00
2242fc5ac8
Optimize the boolean expressions in the AST before generating output
...
Add code optimizing the boolean expressions in the abstract syntax tree
before generating output using the backend.
The main idea behind optimizing the AST is that less repeated terms is
generally better for backend performance. This is especially relevant
to backends that do not perform any query language optimization down
the road, such as those that generate code.
The following optimizations are currently performed:
- Removal of empty OR(), AND()
- OR(X), AND(X) => X
- OR(X, X, ...), AND(X, X, ...) => OR(X, ...), AND(X, ...)
- OR(X, OR(Y)) => OR(X, Y)
- OR(AND(X, ...), AND(X, ...)) => AND(X, OR(AND(...), AND(...)))
- NOT(NOT(X)) => X
A common example for when these suboptimal rules actually occur in
practice is when a rule has multiple alternative detections that are
OR'ed together in the condition, and all of the detections include a
common element, such as the same EventID.
This implementation is not optimized for performance and will perform
poorly on very large expressions.
2018-10-02 21:14:25 +02:00
468af42de5
Add missing event id list handling in PowerShell backend
2018-09-29 14:43:28 +02:00
c289484c5c
Improve default field handling in PowerShell backend
2018-09-29 12:29:44 +02:00
c66b00356d
Add initial version of PowerShell backend
...
* Add PowerShell backend
* Add PowerShell config file
State: Work in progress :)
See https://github.com/Neo23x0/sigma/issues/94
2018-09-23 21:41:48 +02:00
2fbf17ff34
Addition and resolution of field mapping chains explicitely checks for list
2018-09-13 16:22:29 +02:00
41a8ef2fd9
Implemented resolve_fieldname in FieldMappingChain
2018-09-13 14:56:31 +02:00
2330306db1
Added merged field mapping and log sources dict to config chain
2018-09-13 14:55:05 +02:00
ba76f04fe6
Merging of raw configurations in configuration chains
2018-09-13 13:49:36 +02:00
d81946df39
Stacked configurations
...
- Added log source rewriting
- Removed log source merging condition type setting
- Simplified SigmaLogsourceConfiguration constructor
- Condition is generated in SigmaParser instead of SigmaLogsourceConfiguration
Missing:
- Merging of raw config dict for backends that rely on this (es-dsl)
2018-09-12 23:40:22 +02:00
210f7ac044
Rewrote logsource definition merging to set generator
2018-09-12 22:29:51 +02:00
f3c60a6309
Added tag filtering to sigmac
2018-09-06 00:57:54 +02:00
7f875af1ca
Fixed WDATP backend
...
It never generated any output due to missing return in generate()
method.
2018-09-06 00:31:40 +02:00
1d7722c1cb
Added configuration and field mapping chains
...
Missing: field name mapping of log source conditions.
2018-08-27 00:17:27 +02:00
29bed766dd
removed re-introduced output class from qradar backend. fixed list handling error.
2018-08-21 22:45:12 -07:00
468f040c0a
Merge branch 'qradar-dev'
2018-08-20 21:54:30 -07:00
9a61f40cef
added support flor flow data in qradar backend
2018-08-16 21:44:17 -07:00
a8d1831382
Added aggregation support for qradar backend
2018-08-13 23:04:10 -07:00
dce4b4825d
Fixed aggregations without field name
...
Generated query contained field name "None".
2018-08-10 15:07:07 +02:00
sisecbe