c5c5e1b79b
Added ee-outliers test to Makefile
2020-05-08 17:51:35 +02:00
030898ba9c
Merge branch 'master' into override-coverage
2020-05-02 14:22:03 +02:00
72c2241bb4
Cleanup
...
* Added CI test
* Added changelog entry
2020-04-08 23:39:38 +02:00
0947538228
MDATP schema changes
...
WDATP was renamed to MDATP (Microsoft Defendre ATP).
MDATP also had schema changes recently: https://techcommunity.microsoft.com/t5/microsoft-defender-atp/advanced-hunting-data-schema-changes/ba-p/1043914
The updates reflect these changes
2020-03-09 17:12:41 +01:00
5a2ccbd040
Fixed ArcSight backend visibility
2020-02-24 23:27:22 +01:00
6236429f3d
Added/changed CI tests
2020-02-24 23:21:11 +01:00
fa4c76871f
Added CI test for sql backend
2020-02-21 22:27:55 +01:00
638d461b16
Added ala-rule backend to CI testing
2020-01-13 13:47:11 +01:00
530ac854df
Added sigma2attack to CI testing
2019-12-20 22:53:22 +01:00
b701e9be50
Added ECS proxy configuration
2019-12-09 16:34:07 +01:00
d8e1f56219
Add source distribution for PyPi when building
...
Add sdist when building. This makes it easier to build packages from PyPi for example Debian PPA pkgs etc.
This will not affect anything else, just make the source distribution available in PyPi as a tar.gz archive.
If this gets merged, please bump the version and push to PyPi as well.
2019-12-06 15:45:28 +01:00
8d8530be2a
Added UUID check to CI tests
2019-11-12 23:15:30 +01:00
91e48d8c1b
Adding setup links and fixing test that would crash Not node, but not seen in prod rules.
2019-10-27 11:56:32 -05:00
d759896e07
Make coverage binary overridable
...
This makes it possible to pass a different coverage program to make
test, e.g.:
make test COVERAGE=python3-coverage
2019-10-23 15:42:25 +02:00
d5885686fc
Sigmatools release 0.12
...
* Value modifiers
* Config name cleanup
2019-08-01 23:45:07 +02:00
805c739611
Merge branch 'devel-modifiers'
2019-07-31 23:44:10 +02:00
0ca15e5c5e
Added test case for value modifiers
2019-07-16 23:14:55 +02:00
b9ff280209
Cleanup of configuration names
2019-07-14 00:50:15 +02:00
6fab5d7f23
Improved testing and removed dead&debug code
2019-06-29 00:09:53 +02:00
0c7151c901
Watcher backend default options, refactoring and testing
2019-06-28 23:22:16 +02:00
67707b6c82
Added test for new elastalert-dsl backend
2019-05-30 22:38:12 +02:00
11ed7e7ef8
Check for valid configuration/backend combinations
2019-05-20 01:00:33 +02:00
e271484eef
Load configurations via new config management
2019-05-20 00:27:35 +02:00
6918784e87
Configuration order checking
2019-04-23 00:54:10 +02:00
d0bd8a2a41
Mandatory configuration for most backends
2019-04-22 23:40:21 +02:00
5e973a6321
Fixes and CI testing of --backend-config
2019-03-15 23:46:38 +01:00
3f7e08733a
Added backend option 'sysmon' for ala backend
2019-03-15 23:26:15 +01:00
8d1723e65c
Merge branch 'master' of https://github.com/tuckner/sigma into tuckner-master
2019-03-15 23:06:08 +01:00
6d97c6d0bb
Extended elastalert CI testing
2019-03-08 00:04:43 +01:00
1182ee2de2
added ala to makefile
2019-03-07 10:43:22 -06:00
c922f7d73f
Merge branch 'master' into project-1
2019-02-26 00:24:46 +01:00
3c7f46a6cd
Added rule test to CI testing
2019-01-23 23:31:36 +01:00
a9cf14438c
Merge branch 'master' into project-1
2019-01-14 22:36:15 +01:00
b520897176
Added CI testing for SumoLogic backend
2018-12-10 22:36:08 +01:00
1118b80288
Added elastalert backend to CI testing
2018-11-29 00:00:00 +01:00
6b8ddd6ac0
Added CI test for NetWitness backend
2018-11-07 22:36:34 +01:00
42ed8acec9
Improved test coverage
...
* Adding tests
* Removal of coverage measurement for debugging code
2018-11-04 23:28:40 +01:00
0fd8b986fd
Added CI tests
2018-10-18 16:14:16 +02:00
5609728a8a
included XPack Watcher JSON output in CI tests
2018-10-18 14:56:21 +02:00
44ff9d154e
Increased test coverage for mapping corner cases
2018-10-16 14:53:12 +02:00
a61b3d352a
Added test cases
...
* Generic log sources
* Splunk index queries
2018-10-15 15:24:18 +02:00
85ad10d558
Use mktemp if tempfile is not available, fixes make for macOS
2018-10-02 22:17:03 +02:00
14337a2aac
Tests: PowerShell backend tests
2018-09-24 13:23:38 +02:00
13e41f29d6
Added CI test for tag filtering
2018-09-06 01:05:31 +02:00
91e6b8ca6b
Merging refactoring changes into master
2018-07-22 09:23:07 +02:00
c8e21b3f24
Fixing after split
...
* Fixing imports
* Discovery in new sub modules
2018-07-21 01:09:02 +02:00
52e4910ab6
Added QRadar backend to CI testing
2018-07-17 22:56:31 +02:00
0bacba05aa
Added backend 'splunkxml' to CI tests
2018-07-02 23:20:02 +02:00
7d1b801858
Merge branch 'devel-sigmac-wdatp'
2018-06-22 00:43:23 +02:00
d8e036f737
sigmac: Parameter for ignoring "not supported" errors
...
Used to pass tests with complete rule set that would fail for backends
which target systems don't support required features.
2018-06-22 00:23:59 +02:00
Remco Hofman