0a5caae5df
Merge branch 'master' of https://github.com/lsoumille/sigma into lsoumille-master
2018-11-28 23:53:15 +01:00
99e0a4defb
fix: SPARK config duplicate identifier
2018-11-27 14:05:13 +01:00
50c74b94bc
add elastalert backend support
2018-11-23 20:39:15 +01:00
c848c473a3
Error when empty fields attribute
2018-11-23 15:37:42 +01:00
31eae25756
Indentation error
2018-11-23 15:20:17 +01:00
e43909678e
Added the fields attribute parser
...
Make a table with the fields present in the fields attribute
2018-11-23 15:11:12 +01:00
c2eb87133d
Distinct count in aggragation function
...
Added dc() instead of count() when group-by field is present. Because count() doesn't do a distinct count in Splunk. Must be the dc() function instead.
2018-11-23 15:04:08 +01:00
aa1a953a65
Moved node dumping code to generic location
2018-11-21 23:22:38 +01:00
26d888aec3
Removed "not null" handling code
...
Feature was removed some time ago.
2018-11-21 22:56:48 +01:00
9e28669c33
Backend es-qs return quotes on empty or whitespace-only string
2018-11-21 22:29:12 +01:00
49d464f979
Fixed wildcards in es-qs backend
2018-11-20 23:23:54 +01:00
396a030ed1
Removed duplicate code
2018-11-07 22:52:12 +01:00
116a0e9f03
Merge branch 'master' of https://github.com/tuckner/sigma into tuckner-master
2018-11-07 22:27:41 +01:00
5053cc4e95
Fixed optimizing of not conditions with subexpressions
...
Optimization pass traversal is cut at ConditionNOT nodes.
2018-11-07 13:54:45 +01:00
a88b1e81ec
Optimizer debugging code cleanup
...
* Removed commented debugging code
* Output to stdin
* Coverage exception for _dumpNode
2018-11-07 13:49:08 +01:00
42ed8acec9
Improved test coverage
...
* Adding tests
* Removal of coverage measurement for debugging code
2018-11-04 23:28:40 +01:00
418f8d10a3
Wrap conditions generated by mappings into sub-expression
2018-11-04 23:00:04 +01:00
0e4842962b
Added tests
2018-11-04 22:16:20 +01:00
ca6ba4a85b
Added NetWitness backend and tests
2018-10-31 14:24:14 -05:00
26f73d60fa
Added NetWitness backend and tests
2018-10-31 14:07:59 -05:00
eacfaa7460
Check for forbidden null values in list items in Splunk backend
2018-10-27 01:07:03 +02:00
423a73efd5
Dropped .py suffix
2018-10-22 23:02:05 +02:00
b2d6d73034
Added requirements
2018-10-22 22:43:59 +02:00
16e3838a90
Renamed script
2018-10-19 21:23:33 +02:00
6b14930302
Recursive path traversal
2018-10-19 21:21:33 +02:00
67b416379f
Improved import of multiple rules
2018-10-19 19:53:00 +02:00
0cc8b77307
Merge branch 'master' of https://github.com/pivotforensics/sigma into pivotforensics-master
2018-10-18 15:56:26 +02:00
e501c4a5b9
Added additional output type 'json' to the xpack-watcher backend which prints each watcher as compress json, one watcher per line
2018-10-17 10:38:56 +02:00
265ce115a0
Fixed conditional field mapping usage in mapping chains
2018-10-16 13:57:51 +02:00
a61b3d352a
Added test cases
...
* Generic log sources
* Splunk index queries
2018-10-15 15:24:18 +02:00
5b33713ef8
Quick fix for string formatting bug
2018-10-13 20:21:37 -05:00
38ec257f7e
Re-doing LogName formatting
2018-10-13 20:18:57 -05:00
9f48265eb1
Adding re.sub for LogName that accounts for expression grouping
2018-10-13 20:09:54 -05:00
7e184f01c6
Removing invalid fieldmapping
2018-10-13 19:53:39 -05:00
bbb67fbba4
Adding support for reading sigma rule from stdin in sigmac
2018-10-07 10:11:47 -05:00
aabaa0257b
Merge branch 'master' of https://github.com/Neo23x0/sigma
2018-10-06 20:12:15 -05:00
4b85a34b34
Added CSV option to powershell backend
2018-10-06 20:08:20 -05:00
e28bc35cad
Apply field mappings in generation of log source condition
2018-10-06 23:38:35 +02:00
fc45df144c
Improve the comments on the optimizer
2018-10-03 13:44:03 +02:00
87aa1b5521
Move optimizer to sigma.parser.condition to enable it for all backends
2018-10-03 00:24:31 +02:00
cd3661b60c
Fix optimization of NOT corner cases
2018-10-02 22:48:33 +02:00
bed88cf813
Make uniq work for lists within definitions
2018-10-02 22:12:54 +02:00
7165128fa5
Remove None from AST - fixes None-related test failures
2018-10-02 21:44:37 +02:00
2242fc5ac8
Optimize the boolean expressions in the AST before generating output
...
Add code optimizing the boolean expressions in the abstract syntax tree
before generating output using the backend.
The main idea behind optimizing the AST is that less repeated terms is
generally better for backend performance. This is especially relevant
to backends that do not perform any query language optimization down
the road, such as those that generate code.
The following optimizations are currently performed:
- Removal of empty OR(), AND()
- OR(X), AND(X) => X
- OR(X, X, ...), AND(X, X, ...) => OR(X, ...), AND(X, ...)
- OR(X, OR(Y)) => OR(X, Y)
- OR(AND(X, ...), AND(X, ...)) => AND(X, OR(AND(...), AND(...)))
- NOT(NOT(X)) => X
A common example for when these suboptimal rules actually occur in
practice is when a rule has multiple alternative detections that are
OR'ed together in the condition, and all of the detections include a
common element, such as the same EventID.
This implementation is not optimized for performance and will perform
poorly on very large expressions.
2018-10-02 21:14:25 +02:00
468af42de5
Add missing event id list handling in PowerShell backend
2018-09-29 14:43:28 +02:00
c289484c5c
Improve default field handling in PowerShell backend
2018-09-29 12:29:44 +02:00
1c2431f33b
Merge pull request #169 from Karneades/fix-aggregation-exeption
...
Add rule filename to "not implemented" exception output
2018-09-26 11:50:25 +02:00
c66b00356d
Add initial version of PowerShell backend
...
* Add PowerShell backend
* Add PowerShell config file
State: Work in progress :)
See https://github.com/Neo23x0/sigma/issues/94
2018-09-23 21:41:48 +02:00
fe6f4c7475
Add rule filename to exception output for unsupported aggregation
2018-09-23 19:12:50 +02:00
1d12fc290c
Added Winlogbeat configuration
2018-09-20 12:08:11 +02:00
Thomas Patzke