1bea284280
Added Windows Driver Framework log source to configs
2017-11-09 08:42:58 +01:00
e83e3a0c07
Bugfixes in Splunk config
2017-11-09 08:41:07 +01:00
b03f9359ec
sigmac: Added rule filter
2017-11-02 00:02:15 +01:00
732f01878f
Sigma rule collection YAML action documents
2017-11-01 00:17:55 +01:00
d0b2bd9875
Multiple rules per file
...
* New wrapper class SigmaCollectionParser parses all YAML documents
contained in file and handles multiple SigmaParser instantiation.
* Exemplary extended one security/4688 rule to security/4688 + sysmon/1
2017-10-31 23:06:18 +01:00
5743e25931
Added logging framework
2017-10-31 22:13:20 +01:00
720c992573
Dropped within keyword
...
Covered by timeframe attribute.
Fixes issue #26 .
2017-10-30 00:25:56 +01:00
012cb6227f
Added proper handling of null/not null values
...
Fixes issue #25
2017-10-29 23:57:39 +01:00
5fa9e685b1
Splitted parts of generate to generateQuery in backend code
2017-10-25 00:03:03 +02:00
6d0e85fcfa
Fixed Splunk backend ( #50 )
2017-10-24 23:48:47 +02:00
65e1f8ec2b
Increased test coverage
...
* more tests
* removed unneeded code
* increased coverage fail threshold
2017-10-23 23:30:44 +02:00
3389656a5b
Added ELK default index config
2017-10-23 00:45:33 +02:00
7f93d3ca47
Kibana backend throws exception when multiple indices appear
...
* Introduced backend errors with handling in sigmac
2017-10-23 00:45:01 +02:00
cb9aeac7d9
Added default index handling
...
* Removed default index handling from backend code
* Added default indices to config templates
2017-10-23 00:08:39 +02:00
ec996e7353
Improved test coverage
2017-10-19 17:42:56 +02:00
5449a12a14
Added GrepBackend
...
Moved field quoting/filtering into QuoteCharMixin
2017-10-18 19:03:38 +02:00
54cf9af0c9
Removed ELK Sysmon config
...
It's contained in ELK Windows config
2017-10-18 15:23:55 +02:00
b8eedfe3f0
Fixes and refactoring of KibanaBackend and XPackWatcherBackend
...
* Moved unnecessary code out of condition loop
* Index specific rule-name not appended to rulename variable used later
from other rule/index.
* Merged condition loop
2017-09-30 23:22:05 +02:00
1d314e326e
sigmac: MultiRuleOutputMixin
...
* Moved rule name generation into mixin
* KibanaBackend and XPackWatcherBackend now use this mixin instead of
doing the same thing in both classes.
2017-09-30 01:03:08 +02:00
b47e3e45a8
Merge branch 'devel-sigmac'
2017-09-22 00:31:22 +02:00
d410adb397
sigmac: X-Pack Watcher backend improvements
...
* Renamed backend class according to convention
* Output types: curl (default) and plain
* Prefix of rule names
* Indices from configuration
* Support for multiple conditions per rule
* Usage of parsed condition
* Support for all condition operators
* Fixed bug preventing from passing multiple options to backend
* Added to CI tests
2017-09-22 00:28:35 +02:00
62eb3b2923
Merge branch 'devel-sigmac' of https://github.com/megadevx/sigma into devel-sigmac-watcher
2017-09-19 23:08:04 +02:00
545e05370f
Added first config for logstash-linux project
...
URL: https://github.com/thomaspatzke/logstash-linux
2017-09-17 00:36:04 +02:00
a18b8eca52
sigmac: changed backend description for kibana backend
2017-09-17 00:31:25 +02:00
270ab9ba78
Added backend options
...
* generic support for backend-specific options
* kibana backend option for title prefix
2017-09-16 23:46:40 +02:00
c8a66e48b6
sigmac: improved Kibana backend
...
* added fields from rules
* default index if none is matching
2017-09-16 00:39:37 +02:00
d3201229b0
sigmac: Fixed matching of log sources between rules and configuration
2017-09-16 00:32:31 +02:00
9bc8e12a4f
Created a X-Pack Watcher output.
...
This is has only been tested slightly.
2017-09-15 09:49:57 -05:00
135e389334
Created a X-Pack Watcher output.
...
This is has only been tested slightly.
2017-09-15 09:46:37 -05:00
e5da26578d
sigmac/kibana backend: index names from configuration
2017-09-11 00:30:01 +02:00
77a3e7ed91
Code cleanup
2017-09-11 00:27:14 +02:00
be3c0cfb89
sigmac: Kibana backend, first version
...
* totally untested!
* only supports searches
* no visualizations/aggregation expressions
* some fields are filled with default values (see code comments)
2017-09-05 00:14:13 +02:00
c5fc74f440
Further backend changes
...
* backends get complete SigmaParser objects instead of condition
* addition of finalize step for backends
* Renaming of output classes
2017-09-04 00:56:04 +02:00
39381305d8
sigmac: Generic Text File Output
...
Moved output logic into generic class.
2017-08-29 00:05:59 +02:00
edf2787402
Removed some spaces and added Win 10 WMI eventlog
2017-08-22 10:04:56 +02:00
487ab99507
Changed sigmac error behavior on I/O errors
2017-08-07 08:54:18 +02:00
d84f9dcc1c
Aggregation 'near' raises NotImplementedError in backends splunk and logpoint
2017-08-05 23:48:28 +02:00
f5b07dc9af
Added semantic parsing of near expressions
2017-08-05 00:28:22 +02:00
d17604d007
Merge branch 'master' into travis-test
2017-08-03 00:11:08 +02:00
5706361464
Parsing of "near ... within" aggregation operator
...
* Operator is only parsed. No processing or passing of parsed data to
backends.
* Changed rule sysmon_mimikatz_inmemory_detection.yml accordingly.
2017-08-03 00:05:48 +02:00
52525236a5
sigmac: added parameter to control error behavior
...
* --defer-abort
* --ignore-not-implemented
2017-08-02 00:56:22 +02:00
3495bac9cb
sigmac: return error codes
2017-07-31 00:31:49 +02:00
43c4486de0
Added LogPoint aggregation
...
Added generateAggregation function for LogPoint
2017-06-19 15:21:29 +02:00
c1f5bd1540
Sigmac bugfix: showing faulty condition
2017-06-12 10:07:15 +02:00
9d49daecea
Restructured backends
...
Moved most logic into generic base class SingleTextQueryBackend which is
configured by class variables.
2017-06-02 23:43:45 +02:00
6a29884615
Structured backends module with comments
2017-05-26 23:42:49 +02:00
998bb0079d
Fixed Splunk config for sigmac again
2017-05-26 22:40:06 +02:00
18a9fd18ef
Fixed Splunk configuration
...
Substituted source: with sourcetype:
2017-05-26 00:13:30 +02:00
f66085b198
Added eventlog source DNS Server to configs
2017-05-08 13:09:17 +02:00
05e9d1e1e9
Check if aggregation is present in BaseBackend
...
Caused NotImplementedError in ElasticsearchQueryStringBackend.
2017-04-17 00:11:20 +02:00
Florian Roth