bd20ffdad9
sigmac/kibana: curl URL quoted
2018-03-21 00:22:00 +01:00
3f5f3a8d50
sigmac: Remove problematic characters from rule identifiers
2018-03-17 00:44:50 +01:00
f6858c436a
sigmac: Kibana curl output generates one index pattern line per pattern
2018-03-16 23:53:12 +01:00
13ec4c3e3b
sigmac: Kibana curl importer script
2018-03-11 00:25:12 +01:00
7141729ffc
sigma/parser: Introduced new conditions
...
* Any definition: 1 of them
* All definitions: all of them
* Any of selected definitions: 1 of def* (wildcard)
* All of selected definitions: all of def* (wildcard)
2018-03-06 23:13:42 +01:00
647fc6187a
sigmac: Added proper 'Content-Type' header for xpack-watcher backend
2018-03-04 22:58:15 +01:00
89aa300bbc
Improved xpack-watcher actions
...
* Log and mail
* Details in message
2018-02-09 00:03:41 +01:00
8336929d76
XPack Watcher Backend: Improved aggregation capabilities
...
* Aggregation with "...count(field)...", "...by field..." and
combination of both
* Still only count() supported
2018-02-08 22:17:35 +01:00
4762a1cc30
Removed abandoned SigmaAggregationParser.trans_timeframe() method
2018-02-05 23:30:00 +01:00
ec3f0f6d60
Fixed before/after logic
...
If nothing was generated "None" was printed.
2018-02-01 22:49:02 +01:00
76bdcba71f
Added rulecomment option to all single-query output backends
...
Prints comment with rule before output.
2018-01-27 23:48:10 +01:00
f3d19f394e
Fixed encoding issues
...
Some OS environments don't use UTF-8 as default encoding. Enforced it
for output files and stdout.
2017-12-13 00:12:56 +01:00
09d40ab2da
Finished packaging and refactoring
2017-12-08 22:32:39 +01:00
68d8afe4e6
Intermediate refactoring commit: moving code into package
...
Further splitting sigma.py into smaller parts.
2017-12-08 21:45:05 +01:00
Thomas Patzke