7d159fb980
sumologic backend: review with inspiration from arcsight
2019-02-03 12:53:58 -05:00
6215a694a8
Remove escaping from '\\*' in es-dsl backend
2019-02-02 23:51:11 +01:00
8a0784ad33
Fixed escaping of \\*
2019-02-02 00:18:58 +01:00
516bfc88ff
Added rule: RDP login from localhost
2019-01-28 22:43:22 +01:00
3eaf83cf5a
Improved configurations
...
Added Security/4688 field mappings
2019-01-16 23:37:18 +01:00
ba64f485ac
Added generic Windows audit log configuration
2019-01-16 22:41:42 +01:00
4bc4c94a91
sigma2genericsigma: preserve dict order
2019-01-16 22:37:32 +01:00
2fd88c837d
Added generic sigma rule support to WDATP backend
...
* Process creation rules
2019-01-14 23:54:05 +01:00
4e83bfeb16
Fixed merge bugs
2019-01-14 22:54:26 +01:00
a9cf14438c
Merge branch 'master' into project-1
2019-01-14 22:36:15 +01:00
8336b47530
Merge branch 'master' of https://github.com/Neo23x0/sigma
2019-01-14 22:12:37 +01:00
cc4b806b94
Sigma tools release 0.7.1
2019-01-14 00:26:03 +01:00
5cba0b9946
Merge pull request #223 from m0jtaba/master
...
extending the qradar backend to allow for timeframe query
2019-01-13 23:55:55 +01:00
7634128143
Generate list of converted file in conversion to generic rules
2019-01-13 23:53:11 +01:00
e585858128
Optimization in conversion to generic rules
...
* only create necessary output files in directory output mode
* delete empty detections and empty detection sections
* Merge equal documents
* Merge reduced collections into one YAML document in common case
2019-01-13 23:45:11 +01:00
aa37ef2559
extending the qradar backend to allow for timeframe query
2019-01-11 03:33:49 +00:00
44f18db80d
Fix YAML errors reported by yamllint
...
Especially the config for ArcSight, that was invalid:
tools/config/arcsight.yml
89:5 error duplication of key "product" in mapping (key-duplicates)
90:5 error duplication of key "conditions" in mapping (key-duplicates)
rules/windows/builtin/win_susp_commands_recon_activity.yml
10:9 error too many spaces after colon (colons)
2019-01-10 09:51:39 +01:00
9f56b9e99b
Output all YAML documents if one changed
...
Some Sigma rule collections contain YAML documents that reduce to almost
nothing because they only contain EventID definitions. Previous behavior
would filter the part with the remaining selection.
2019-01-08 23:27:16 +01:00
bf9a567afd
Fixed issues in converter
2019-01-06 23:57:09 +01:00
faeaf1dfef
Added first version of generic sigma rules conversion tool
2019-01-06 23:46:23 +01:00
73b0c3a25b
Fixed wildcard issue for es-dsl backend
...
Moved field mapping code into mixin shared by es-qs and es-dsl.
2018-12-21 14:10:45 +01:00
75c7d65240
Merge pull request #211 from Cyb3rWard0g/master
...
Field-Index Mapping File & SIGMA Rules Field names fix
2018-12-19 00:38:06 +01:00
ffd43823cf
Fixed wildcard issue in es-qs backend and depending
...
See GitHub issue #194 . Fix for es-dsl is pending.
2018-12-19 00:33:12 +01:00
a0486edeea
Field-Index Mapping File & SIGMA Rules Field names fix
...
+ Updated HELK field-index mapping file
+ After going through all the fields with 'fieldlist' output, I found a few rules that fixed.
2018-12-11 09:27:26 +03:00
68866433e8
Merge branch 'juju4-devel-sumo'
2018-12-10 22:37:58 +01:00
4175d0cdd5
Fixed config and added index field
...
* Added index field _index to backend implementation
* Fixed index values in config
2018-12-10 22:37:39 +01:00
93d1d700d4
Merge remote-tracking branch 'upstream/master'
2018-12-10 07:04:30 +03:00
1f707cb37c
Adding Sumologic backend
2018-12-09 17:55:51 -05:00
2091c90538
Fixed ElastAlert *_key options
...
* Always use .keyword field instead of analyzed one
* Fixed 'null' value if group field was not set
2018-12-09 22:33:23 +01:00
8c577a329f
Improve Rule & Updated HELK SIGMA Standardization Config
...
Rule should be focusing on the 'process_command_line' field and not just on any value of any event generated by powershell.exe.
SIGMA HELK standardization config updated to match latest HELK Common Information Model
2018-12-08 11:30:21 +03:00
246ad7c59a
Revert "Fixed wildcards in es-qs backend"
...
This reverts commit 49d464f979#194 broke the generation of many other rules,
see #203 .
2018-12-05 09:07:07 +01:00
f9d9d653dc
Merge pull request #199 from sisecbe/patch-1
...
Distinct count in aggragation function
2018-12-04 23:42:16 +01:00
2bf0170956
Merge pull request #202 from tuckner/master
...
Fixed backslash escape
2018-12-03 22:22:53 +01:00
2c5c92ab0a
fixed backslash escape
2018-12-03 15:09:29 -06:00
0a5caae5df
Merge branch 'master' of https://github.com/lsoumille/sigma into lsoumille-master
2018-11-28 23:53:15 +01:00
99e0a4defb
fix: SPARK config duplicate identifier
2018-11-27 14:05:13 +01:00
50c74b94bc
add elastalert backend support
2018-11-23 20:39:15 +01:00
c848c473a3
Error when empty fields attribute
2018-11-23 15:37:42 +01:00
31eae25756
Indentation error
2018-11-23 15:20:17 +01:00
e43909678e
Added the fields attribute parser
...
Make a table with the fields present in the fields attribute
2018-11-23 15:11:12 +01:00
c2eb87133d
Distinct count in aggragation function
...
Added dc() instead of count() when group-by field is present. Because count() doesn't do a distinct count in Splunk. Must be the dc() function instead.
2018-11-23 15:04:08 +01:00
aa1a953a65
Moved node dumping code to generic location
2018-11-21 23:22:38 +01:00
26d888aec3
Removed "not null" handling code
...
Feature was removed some time ago.
2018-11-21 22:56:48 +01:00
9e28669c33
Backend es-qs return quotes on empty or whitespace-only string
2018-11-21 22:29:12 +01:00
49d464f979
Fixed wildcards in es-qs backend
2018-11-20 23:23:54 +01:00
396a030ed1
Removed duplicate code
2018-11-07 22:52:12 +01:00
116a0e9f03
Merge branch 'master' of https://github.com/tuckner/sigma into tuckner-master
2018-11-07 22:27:41 +01:00
5053cc4e95
Fixed optimizing of not conditions with subexpressions
...
Optimization pass traversal is cut at ConditionNOT nodes.
2018-11-07 13:54:45 +01:00
a88b1e81ec
Optimizer debugging code cleanup
...
* Removed commented debugging code
* Output to stdin
* Coverage exception for _dumpNode
2018-11-07 13:49:08 +01:00
42ed8acec9
Improved test coverage
...
* Adding tests
* Removal of coverage measurement for debugging code
2018-11-04 23:28:40 +01:00
juju4