7fb2e2b845
Added AppLocker log source
2020-07-13 20:29:13 +00:00
e376948258
Added AppLocker log source
2020-07-13 20:27:52 +00:00
0d925896b9
Added AppLocker log source
2020-07-13 20:23:42 +00:00
c30a256030
Added AppLocker log source
2020-07-13 20:21:46 +00:00
1da229e3a9
Added AppLocker log source
2020-07-13 20:20:28 +00:00
3a19e3cf23
Added AppLocker log source
2020-07-13 20:18:01 +00:00
ca7cf8478d
- IntegrityLevel mapping to integritylevel
2020-07-08 19:37:24 +03:00
8855a87dbf
- TargetProcessAddress mapping should be as startaddress mapping
...
- remove extra '-'
2020-07-08 17:35:57 +03:00
8889ae21ca
DestinationPort to network-traffic:dst_port mapping fix
2020-07-08 14:31:04 +03:00
50ef79b398
Custom STIX object "x-sigma" for fields that missing mapping, so the pattern is STIX valid
2020-07-08 14:09:26 +03:00
9bcff522b6
Merge branch 'master' of https://github.com/rashimo/sigma into pr-709
2020-07-07 23:12:03 +02:00
acbab2db4b
stix backend + mapping configurations for windows logs and qradar
2020-07-07 15:04:16 +03:00
c8ca55b3e4
fix: duplicate wrong old key
2020-07-06 17:14:59 +02:00
cc31ed8b84
fix: missing NTLM log source in THOR
2020-07-06 17:07:06 +02:00
939156fa6d
Introduced dns_query log source category
2020-07-05 23:29:51 +02:00
0df21289a0
Merge branch 'dns-fixes' of https://github.com/rtkbkish/sigma into pr-893
2020-07-05 23:24:56 +02:00
57cb255208
Merge pull request #864 from cclauss/patch-3
...
Fix undefined names in sigma2misp.py
2020-07-05 23:16:22 +02:00
8b3b312c4e
Proposed fix for https://github.com/Neo23x0/sigma/issues/889
...
This change removes dns events from the network connection category. The
one change is that sysmon_regsvr32_network_activity.yml needs to test
the network connection category separately from the DNS event id.
2020-07-03 16:28:19 -04:00
6420820eb2
Merge pull request #871 from Christopolos94/master
...
Update to mdatp backend
2020-07-03 11:29:01 +02:00
43e5ae5d24
Added Windows NTLM log source + fixes
2020-07-02 23:20:36 +02:00
9c0f9f398f
refactor: sysmon rule cleanup > generlization
2020-07-01 10:58:39 +02:00
6ed1ea6509
Updating the mdatp backend file as it is currently impossible to set an ActionType as there is no mapping to EventType
2020-06-30 14:49:29 +01:00
ae842a65cb
Windows Defender rules and logsource
2020-06-28 10:55:32 +02:00
9dc3940c07
Fix undefined names in sigma2misp.py
...
create_new_event() -> create_new_event(args, misp) to fix:
flake8 testing of https://github.com/Neo23x0/sigma on Python 3.8.3
% _flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics_
```
./tools/sigma/sigma2misp.py:11:16: F821 undefined name 'misp'
if hasattr(misp, "new_event"):
^
./tools/sigma/sigma2misp.py:12:16: F821 undefined name 'misp'
return misp.new_event(info=args.info)["Event"]["id"]
^
./tools/sigma/sigma2misp.py:12:36: F821 undefined name 'args'
return misp.new_event(info=args.info)["Event"]["id"]
^
./tools/sigma/sigma2misp.py:14:13: F821 undefined name 'misp'
event = misp.MISPEvent()
^
./tools/sigma/sigma2misp.py:15:18: F821 undefined name 'args'
event.info = args.info
^
./tools/sigma/sigma2misp.py:16:12: F821 undefined name 'misp'
return misp.add_event(event)["Event"]["id"]
^
6 F821 undefined name 'misp'
6
```
2020-06-28 07:02:41 +02:00
0ee47e118c
Merge branch 'pr-848'
2020-06-28 01:04:30 +02:00
89ed9f3763
Merge pull request #819 from cclauss/patch-2
...
Undefined name: from .exceptions import SigmaCollectionParseError
2020-06-28 00:37:09 +02:00
09378b5ebf
Fixed unsupported attempt to index a set
2020-06-28 00:27:33 +02:00
415f826ece
Merge branch 'default-pop' of https://github.com/rtkbkish/sigma into rtkbkish-default-pop
2020-06-28 00:09:39 +02:00
b1e4f44c21
Merge pull request #823 from Kuermel/master
...
Add more Options for XPackWatcherBackend (Elasticsearch)
2020-06-28 00:03:04 +02:00
d1f37bdbd4
Merge pull request #828 from stevengoossensB/master
...
Split rules based on Sysmon event ID
2020-06-28 00:00:32 +02:00
de5e453e19
Merge pull request #831 from 404d/cbr-backend-tweaks
...
Add parentheses around field list groups in CB
2020-06-27 23:39:57 +02:00
da46ff6e93
docs: descriptions for source configs
2020-06-25 13:59:51 +02:00
825bda397d
desc: better descriptions in help for backends and configurations
2020-06-25 13:21:43 +02:00
07c0a6558e
fix: wording on sysmon mapping file
2020-06-24 17:49:42 +02:00
f3fedef8f5
Changed category names and remove sysmon log source
2020-06-24 17:41:21 +02:00
203aa192c7
Fix multiple references to default field mapping in same rule
...
If there is a default mapping specified for a fieldmapping and that field is
referenced multiple times in the rule, the default mapping will be "pop"ped
and return the unmapped key on subsequent uses.
Don't pop the value. Just return the first entry.
2020-06-18 13:01:31 -04:00
d371fd864c
Merge pull request #834 from ebeahan/elastic-updates
...
Elastic section updates
2020-06-13 10:04:49 +02:00
f907c49ab5
Improved test coverage
...
* Added test case
* Removed unused code
2020-06-13 01:11:08 +02:00
b129556388
Automatic inclusion of all configuration files
2020-06-13 00:04:45 +02:00
80e8f0e5fa
Release 0.17.0
2020-06-12 23:52:06 +02:00
24d83b80cd
Merge branch 'script_entry_points'
2020-06-12 23:13:11 +02:00
bba0b2d851
Elastic documentation improvements
2020-06-12 13:40:39 -05:00
aac1af1832
typo, was missing the = and *.
...
also, show option when using case insensitive for everything, how to "exclude" a field from that regex.
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com >
2020-06-12 11:37:32 -04:00
bbcbed4742
Add parentheses about field list groups in CB
...
This should address the grouping issue from #660 .
The grouping issue was solved by just slamming some parentheses around the fields in the listExpression field.
2020-06-11 15:33:02 +02:00
423baafa2a
Added rules for different sysmon categories and added the category definition
2020-06-10 15:02:15 +02:00
915ea1cc67
Merge branch 'script_entry_points' into master
2020-06-10 00:51:47 +02:00
565febd39d
README updated
2020-06-09 23:25:09 +02:00
f4fe425fa7
update readme for some analyzed field and keyword field examples
2020-06-09 16:53:50 -04:00
8c61dc9248
Add more Options for XPackWatcherBackend (Elasticsearch)
...
Add action_throttle_period, mail_from adn mail_profile to the XPackWatcherBackend (Elasticsearch)
2020-06-09 20:57:26 +02:00
117ceac492
moved file to ecs-zeek-elastic-beats-implementation.yml
2020-06-09 08:56:01 -04:00
Pushkarev Dmitry