50c74b94bc
add elastalert backend support
2018-11-23 20:39:15 +01:00
c848c473a3
Error when empty fields attribute
2018-11-23 15:37:42 +01:00
31eae25756
Indentation error
2018-11-23 15:20:17 +01:00
e43909678e
Added the fields attribute parser
...
Make a table with the fields present in the fields attribute
2018-11-23 15:11:12 +01:00
c2eb87133d
Distinct count in aggragation function
...
Added dc() instead of count() when group-by field is present. Because count() doesn't do a distinct count in Splunk. Must be the dc() function instead.
2018-11-23 15:04:08 +01:00
9e28669c33
Backend es-qs return quotes on empty or whitespace-only string
2018-11-21 22:29:12 +01:00
49d464f979
Fixed wildcards in es-qs backend
2018-11-20 23:23:54 +01:00
396a030ed1
Removed duplicate code
2018-11-07 22:52:12 +01:00
ca6ba4a85b
Added NetWitness backend and tests
2018-10-31 14:24:14 -05:00
26f73d60fa
Added NetWitness backend and tests
2018-10-31 14:07:59 -05:00
eacfaa7460
Check for forbidden null values in list items in Splunk backend
2018-10-27 01:07:03 +02:00
0cc8b77307
Merge branch 'master' of https://github.com/pivotforensics/sigma into pivotforensics-master
2018-10-18 15:56:26 +02:00
e501c4a5b9
Added additional output type 'json' to the xpack-watcher backend which prints each watcher as compress json, one watcher per line
2018-10-17 10:38:56 +02:00
5b33713ef8
Quick fix for string formatting bug
2018-10-13 20:21:37 -05:00
38ec257f7e
Re-doing LogName formatting
2018-10-13 20:18:57 -05:00
9f48265eb1
Adding re.sub for LogName that accounts for expression grouping
2018-10-13 20:09:54 -05:00
aabaa0257b
Merge branch 'master' of https://github.com/Neo23x0/sigma
2018-10-06 20:12:15 -05:00
4b85a34b34
Added CSV option to powershell backend
2018-10-06 20:08:20 -05:00
87aa1b5521
Move optimizer to sigma.parser.condition to enable it for all backends
2018-10-03 00:24:31 +02:00
cd3661b60c
Fix optimization of NOT corner cases
2018-10-02 22:48:33 +02:00
bed88cf813
Make uniq work for lists within definitions
2018-10-02 22:12:54 +02:00
7165128fa5
Remove None from AST - fixes None-related test failures
2018-10-02 21:44:37 +02:00
2242fc5ac8
Optimize the boolean expressions in the AST before generating output
...
Add code optimizing the boolean expressions in the abstract syntax tree
before generating output using the backend.
The main idea behind optimizing the AST is that less repeated terms is
generally better for backend performance. This is especially relevant
to backends that do not perform any query language optimization down
the road, such as those that generate code.
The following optimizations are currently performed:
- Removal of empty OR(), AND()
- OR(X), AND(X) => X
- OR(X, X, ...), AND(X, X, ...) => OR(X, ...), AND(X, ...)
- OR(X, OR(Y)) => OR(X, Y)
- OR(AND(X, ...), AND(X, ...)) => AND(X, OR(AND(...), AND(...)))
- NOT(NOT(X)) => X
A common example for when these suboptimal rules actually occur in
practice is when a rule has multiple alternative detections that are
OR'ed together in the condition, and all of the detections include a
common element, such as the same EventID.
This implementation is not optimized for performance and will perform
poorly on very large expressions.
2018-10-02 21:14:25 +02:00
468af42de5
Add missing event id list handling in PowerShell backend
2018-09-29 14:43:28 +02:00
c289484c5c
Improve default field handling in PowerShell backend
2018-09-29 12:29:44 +02:00
c66b00356d
Add initial version of PowerShell backend
...
* Add PowerShell backend
* Add PowerShell config file
State: Work in progress :)
See https://github.com/Neo23x0/sigma/issues/94
2018-09-23 21:41:48 +02:00
7f875af1ca
Fixed WDATP backend
...
It never generated any output due to missing return in generate()
method.
2018-09-06 00:31:40 +02:00
1d7722c1cb
Added configuration and field mapping chains
...
Missing: field name mapping of log source conditions.
2018-08-27 00:17:27 +02:00
29bed766dd
removed re-introduced output class from qradar backend. fixed list handling error.
2018-08-21 22:45:12 -07:00
468f040c0a
Merge branch 'qradar-dev'
2018-08-20 21:54:30 -07:00
9a61f40cef
added support flor flow data in qradar backend
2018-08-16 21:44:17 -07:00
a8d1831382
Added aggregation support for qradar backend
2018-08-13 23:04:10 -07:00
dce4b4825d
Fixed aggregations without field name
...
Generated query contained field name "None".
2018-08-10 15:07:07 +02:00
e0b3f91b2a
Removed empty line
2018-08-08 23:15:13 +02:00
af9f636199
Removal of backend output classes
...
Breaking change: Instead of feeding the output class with the results,
they are now returned as strings (*Backend.generate()) or list
(SigmaCollectionParser.generate()). Users of the library must now take
care of the output to the terminal, files or wherever Sigma rules should
be pushed to.
2018-08-02 22:41:32 +02:00
1c9d0a176e
Moved const_start into class definition
2018-07-28 23:51:33 +02:00
df74460629
Fixed imports after config split
2018-07-27 23:54:18 +02:00
1c4c67053c
Fixes for parser split
...
* Fixed imports
* Rename
2018-07-27 00:02:07 +02:00
b76fa884ec
Changed copyright notices accordingly
2018-07-24 00:01:16 +02:00
fbde251ebc
Added missing exception import in ES backend
2018-07-22 09:26:25 +02:00
91e6b8ca6b
Merging refactoring changes into master
2018-07-22 09:23:07 +02:00
cf175d7b7e
Removal from sigma.backends.qradar
2018-07-22 09:14:50 +02:00
097660c678
Splitting backends - Copy qradar.py
2018-07-22 09:12:29 +02:00
c8e21b3f24
Fixing after split
...
* Fixing imports
* Discovery in new sub modules
2018-07-21 01:09:02 +02:00
b85aec6157
Merging backend split branches
2018-07-21 00:59:50 +02:00
3e2184ac61
Removal from sigma.backends.elasticsearch
2018-07-21 00:37:36 +02:00
c2b1a58813
Removal from sigma.backends.wdatp
2018-07-10 23:49:39 +02:00
45782c6328
Removal from sigma.backends.splunk
2018-07-10 23:48:47 +02:00
46f29d2eb2
Removal from sigma.backends.output
2018-07-10 23:47:41 +02:00
2d4145cfe8
Removal from sigma.backends.discovery
2018-07-10 23:46:52 +02:00
lsoumille