2fbf17ff34
Addition and resolution of field mapping chains explicitely checks for list
2018-09-13 16:22:29 +02:00
41a8ef2fd9
Implemented resolve_fieldname in FieldMappingChain
2018-09-13 14:56:31 +02:00
2330306db1
Added merged field mapping and log sources dict to config chain
2018-09-13 14:55:05 +02:00
ba76f04fe6
Merging of raw configurations in configuration chains
2018-09-13 13:49:36 +02:00
d81946df39
Stacked configurations
...
- Added log source rewriting
- Removed log source merging condition type setting
- Simplified SigmaLogsourceConfiguration constructor
- Condition is generated in SigmaParser instead of SigmaLogsourceConfiguration
Missing:
- Merging of raw config dict for backends that rely on this (es-dsl)
2018-09-12 23:40:22 +02:00
210f7ac044
Rewrote logsource definition merging to set generator
2018-09-12 22:29:51 +02:00
f3c60a6309
Added tag filtering to sigmac
2018-09-06 00:57:54 +02:00
7f875af1ca
Fixed WDATP backend
...
It never generated any output due to missing return in generate()
method.
2018-09-06 00:31:40 +02:00
1d7722c1cb
Added configuration and field mapping chains
...
Missing: field name mapping of log source conditions.
2018-08-27 00:17:27 +02:00
29bed766dd
removed re-introduced output class from qradar backend. fixed list handling error.
2018-08-21 22:45:12 -07:00
468f040c0a
Merge branch 'qradar-dev'
2018-08-20 21:54:30 -07:00
9a61f40cef
added support flor flow data in qradar backend
2018-08-16 21:44:17 -07:00
320bb9f8c4
Added rewrite config to generic sysmon configuration
2018-08-14 21:34:54 +02:00
430972231f
Added generic sysmon configuration with process_execution config
2018-08-14 21:34:54 +02:00
a8d1831382
Added aggregation support for qradar backend
2018-08-13 23:04:10 -07:00
dce4b4825d
Fixed aggregations without field name
...
Generated query contained field name "None".
2018-08-10 15:07:07 +02:00
e0b3f91b2a
Removed empty line
2018-08-08 23:15:13 +02:00
f8246e9f49
Removed "not implemented" hints for available options in sigmac
2018-08-04 23:31:29 +02:00
af9f636199
Removal of backend output classes
...
Breaking change: Instead of feeding the output class with the results,
they are now returned as strings (*Backend.generate()) or list
(SigmaCollectionParser.generate()). Users of the library must now take
care of the output to the terminal, files or wherever Sigma rules should
be pushed to.
2018-08-02 22:41:32 +02:00
1c9d0a176e
Moved const_start into class definition
2018-07-28 23:51:33 +02:00
df74460629
Fixed imports after config split
2018-07-27 23:54:18 +02:00
e02af9aa37
Merge config split branches
2018-07-27 23:16:50 +02:00
eb440b3357
Split config - code removal from configuration
2018-07-27 23:02:35 +02:00
36ada66007
Split config - Copy configuration
2018-07-27 23:01:41 +02:00
920c4b061d
Split config - code removal from filter
2018-07-27 22:35:30 +02:00
d235a9e017
Split config - Copy filter
2018-07-27 00:23:22 +02:00
50a6a92d20
Split config - code removal from exceptions
2018-07-27 00:17:35 +02:00
405bc4a0d1
Split config - Copy exception
2018-07-27 00:17:13 +02:00
096bc35447
Split config - code removal from mapping
2018-07-27 00:15:14 +02:00
4ffbb25960
Split config - Copy mapping
2018-07-27 00:13:19 +02:00
1c4c67053c
Fixes for parser split
...
* Fixed imports
* Rename
2018-07-27 00:02:07 +02:00
88a4a5d36a
Merge parser split branches
2018-07-26 23:42:09 +02:00
595327ace4
Split parser - code removal from condition
2018-07-26 23:40:22 +02:00
c8043368bd
Split parser - code removal from rule
2018-07-26 22:43:49 +02:00
294ca20350
Split parser - code removal from collection
2018-07-26 22:28:33 +02:00
3a0de01bad
Split parser - code removal from base
2018-07-26 22:22:21 +02:00
b9425d13df
Split parser - code removal from exceptions
2018-07-26 22:18:21 +02:00
e550bf5c3b
Split parser - Copy base
2018-07-26 22:15:04 +02:00
a2329de03c
Split parser - Copy rule
2018-07-26 22:07:38 +02:00
1abb13c5d9
Split parser - Copy condition
2018-07-24 00:13:37 +02:00
a8501cb446
Split parser - Copy exceptions
2018-07-24 00:08:23 +02:00
983ee6eeb9
Splitting parser - copying collections
2018-07-24 00:06:02 +02:00
54f5870658
Removed debugging code
2018-07-24 00:04:24 +02:00
b76fa884ec
Changed copyright notices accordingly
2018-07-24 00:01:16 +02:00
fbde251ebc
Added missing exception import in ES backend
2018-07-22 09:26:25 +02:00
91e6b8ca6b
Merging refactoring changes into master
2018-07-22 09:23:07 +02:00
cf175d7b7e
Removal from sigma.backends.qradar
2018-07-22 09:14:50 +02:00
097660c678
Splitting backends - Copy qradar.py
2018-07-22 09:12:29 +02:00
c8e21b3f24
Fixing after split
...
* Fixing imports
* Discovery in new sub modules
2018-07-21 01:09:02 +02:00
b85aec6157
Merging backend split branches
2018-07-21 00:59:50 +02:00
Thomas Patzke