849a5a520d
Conditional field mapping resolve_fieldname now functional
...
Before this method just had some placeholder function that wasn't really
implementing the intended functionality of the conditional field
mapping. Now aggregations get also conditional field mapping
functionality.
2019-10-09 23:57:41 +02:00
d4f89ebc1c
Aggregation on keyword field in es-dsl backend
...
* Fixes #452
* Further fixed reference to count in restriction of results
2019-09-29 23:18:17 +02:00
19f431b6d2
Changed xpack-watcher dateField default to previous value
2019-09-12 00:19:58 +02:00
8f612f743c
Use config dateField in xpack watcher to determine
...
datefield name as in elasticsearch dsl backend
2019-09-11 09:38:03 +02:00
c80cb418cd
Improved QRadar regular expression support
2019-09-05 15:35:26 +02:00
30b6db8299
Fixed ES backend keyword field mapping wildcard match pattern
2019-09-05 12:55:10 +02:00
3b1cbe529e
Elasticsearch keyword field name blacklisting with wildcards
2019-09-05 12:38:32 +02:00
2a60c71b9d
Merge pull request #437 from svent/qradar_regex_modifier
...
QRadar backend: add support for re type modifiers
2019-09-05 10:30:18 +02:00
de5e2045f0
Merge pull request #428 from stevengoossensB/master
...
AQL field selection from signatures
2019-09-05 10:28:02 +02:00
37e179b6a7
Merge pull request #390 from juju4/devel-sumo2
...
sumologic backend: fix index and full mapping coverage
2019-09-05 10:27:19 +02:00
467c8f694c
QRadar backend: add support for re type modifiers
2019-09-03 22:55:48 +02:00
37caccd52e
Includes the trial condition so generic query is generated whenever the fields are not defined
2019-08-26 11:48:40 +00:00
895682aef2
Implementing the fields to be selected
2019-08-26 10:57:43 +00:00
0984293d0c
Support for Malicious cmdlets in ATP
2019-08-20 14:33:08 -07:00
1ea6d00a39
Fix QRadar field name escaping and handling
2019-08-12 23:47:43 +02:00
0708fdd28e
Correctly escape slashes within es-dsl wildcard queries
2019-08-07 12:56:19 +02:00
9c85d5e80f
Merge pull request #406 from tuckner/master
...
Fix ala parsing issues
2019-08-06 10:28:07 +02:00
805c739611
Merge branch 'devel-modifiers'
2019-07-31 23:44:10 +02:00
31c6ffcb61
No escaping for typed values
2019-07-31 23:43:29 +02:00
8f2f1922c6
Merge pull request #1 from Neo23x0/master
...
update fork
2019-07-27 21:27:52 -05:00
1bb29dca26
Implemented type modifiers and regular expressions
2019-07-15 22:52:10 +02:00
576912eb7a
Support OR queries for Elasticsearch 6 and above
2019-07-08 17:12:53 +02:00
2b5a77db53
add sumologic _sourceCategory and _view in aFL
2019-07-06 12:41:56 -04:00
b358d38e68
_index in aFL and mappings working!
2019-07-06 12:41:40 -04:00
f7ba2b3976
fix: bug in sumologic backend with 'null' values
2019-07-02 22:31:10 +02:00
6fab5d7f23
Improved testing and removed dead&debug code
2019-06-29 00:09:53 +02:00
377872c91e
Merge branch 'devel-sumo' of https://github.com/juju4/sigma into juju4-devel-sumo
2019-06-28 23:39:15 +02:00
0c7151c901
Watcher backend default options, refactoring and testing
2019-06-28 23:22:16 +02:00
feac0be8a4
Added 2 more actions on Elasticsearch X-pack Watcher: index and webhook
...
Added timestamp filter query.
2019-06-27 08:54:59 +03:00
654a009c9e
sumologic backend: remove TypeError
2019-06-22 16:49:46 -04:00
559d0f4ba8
sumologic backend: force as string
2019-06-22 16:43:50 -04:00
2df0e9765c
sumologic backend: pycodestyle review - E501
2019-06-22 16:41:57 -04:00
49533a5909
sumologic backend: pycodestyle review
2019-06-22 16:39:13 -04:00
84de12635e
self.debug option, fix multiple keyvalue escapings/cleanValue, inline index for now
2019-06-22 16:19:45 -04:00
a11d800353
Merge branch 'master' into devel-sumo
2019-06-22 09:18:23 -04:00
3529b717cb
fixed backend errors in ala
2019-06-10 09:25:59 -05:00
673973e523
Merge pull request #357 from agix/es_dsl_bug
...
fix missing condition when unique plus timeframe
2019-05-30 22:42:09 +02:00
8023011bb1
Merge branch 'elastalert_dsl_backend' of https://github.com/agix/sigma into agix-elastalert_dsl_backend
2019-05-30 22:33:57 +02:00
89c1d7b63d
Wrong fix, self.queries should be emptied after copied to rule_object
2019-05-29 16:10:14 +02:00
748ac2e206
Dont combine multiple queries
2019-05-29 16:05:53 +02:00
04d91573f3
Merge pull request #355 from agix/allow_empty_keyword
...
Allow empty keyword_field
2019-05-28 21:45:55 +02:00
d866e75750
Be sure there is a key in the single condition
2019-05-27 17:27:16 +02:00
e8a7c5f7b9
fix missing condition when unique plus timeframe
2019-05-27 17:22:28 +02:00
6bf010fb4b
introduce elastalert-dsl
...
(cherry picked from commit 0235ec23200e62766d9f21fbd26ed834991a0b61)
2019-05-27 17:18:19 +02:00
4168c0ec64
Allow empty keyword_field
2019-05-27 15:08:33 +02:00
eb9564557e
Moved generic class discovery code into new tools module
2019-05-26 22:29:07 +02:00
75ec169d5c
added metadata field to the watcher alert
...
While utilizing Kibana to track watches directly from the watch index it became quickly apparent that useful metadata was not available. In my project's case it was the title, description and tags from the sigma rule. By adding them to the metadata field it makes it easier to utilize them in visualizations of the watches themselves. In the future perhaps the contents of the metadata field could be given as an option for each user.
2019-05-22 04:30:47 -07:00
194afa739f
Generate rule name for each condition
...
In backends kibana and xpack-watcher.
Fixes #329
2019-05-21 00:36:19 +02:00
af0bd1b082
Removed debug code from backend option handling
...
Additionally: code simplification
2019-05-21 00:21:52 +02:00
7e163d71eb
Added option to use old URL in xpack-watcher backend
2019-05-21 00:01:21 +02:00
Thomas Patzke