32cf352236
Merge remote-tracking branch 'upstream/master'
2020-07-26 14:56:06 +03:00
dcb07bab2f
Merge pull request #949 from 0xballistics/powershell_backend_fix
...
partial(?) fix of #762
2020-07-25 10:18:05 +02:00
c329f6412d
Fix bug with NOT handling
2020-07-23 11:47:55 -04:00
6c7b4cf408
Revert additional change in base.py
2020-07-23 10:47:22 -04:00
ef9af3730a
Remove unnecessary edits from qradar.py
2020-07-23 10:34:29 -04:00
0e49a6acdf
Default NOT to false for all functions
2020-07-23 10:18:16 -04:00
0fac21f4a3
Remove modifications from base file and override in stix.py
2020-07-23 10:13:30 -04:00
30ff22776a
Fix NOT bug
2020-07-23 09:41:33 -04:00
875360f373
fixed wrong function call for elastalert aggregation. fixes #940
2020-07-20 14:32:30 +02:00
e0476d5ce6
Merge branch 'master' of git://github.com/Neo23x0/sigma
2020-07-15 16:35:29 +01:00
1e5ee5823c
Fix for indentation issue
...
Wrong indentation of line 182 meant that even where config options
were given, the default per backend was being used, rendering
custom config useless.
2020-07-15 16:29:27 +01:00
50ef79b398
Custom STIX object "x-sigma" for fields that missing mapping, so the pattern is STIX valid
2020-07-08 14:09:26 +03:00
9bcff522b6
Merge branch 'master' of https://github.com/rashimo/sigma into pr-709
2020-07-07 23:12:03 +02:00
acbab2db4b
stix backend + mapping configurations for windows logs and qradar
2020-07-07 15:04:16 +03:00
57cb255208
Merge pull request #864 from cclauss/patch-3
...
Fix undefined names in sigma2misp.py
2020-07-05 23:16:22 +02:00
6ed1ea6509
Updating the mdatp backend file as it is currently impossible to set an ActionType as there is no mapping to EventType
2020-06-30 14:49:29 +01:00
9dc3940c07
Fix undefined names in sigma2misp.py
...
create_new_event() -> create_new_event(args, misp) to fix:
flake8 testing of https://github.com/Neo23x0/sigma on Python 3.8.3
% _flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics_
```
./tools/sigma/sigma2misp.py:11:16: F821 undefined name 'misp'
if hasattr(misp, "new_event"):
^
./tools/sigma/sigma2misp.py:12:16: F821 undefined name 'misp'
return misp.new_event(info=args.info)["Event"]["id"]
^
./tools/sigma/sigma2misp.py:12:36: F821 undefined name 'args'
return misp.new_event(info=args.info)["Event"]["id"]
^
./tools/sigma/sigma2misp.py:14:13: F821 undefined name 'misp'
event = misp.MISPEvent()
^
./tools/sigma/sigma2misp.py:15:18: F821 undefined name 'args'
event.info = args.info
^
./tools/sigma/sigma2misp.py:16:12: F821 undefined name 'misp'
return misp.add_event(event)["Event"]["id"]
^
6 F821 undefined name 'misp'
6
```
2020-06-28 07:02:41 +02:00
0ee47e118c
Merge branch 'pr-848'
2020-06-28 01:04:30 +02:00
89ed9f3763
Merge pull request #819 from cclauss/patch-2
...
Undefined name: from .exceptions import SigmaCollectionParseError
2020-06-28 00:37:09 +02:00
09378b5ebf
Fixed unsupported attempt to index a set
2020-06-28 00:27:33 +02:00
415f826ece
Merge branch 'default-pop' of https://github.com/rtkbkish/sigma into rtkbkish-default-pop
2020-06-28 00:09:39 +02:00
b1e4f44c21
Merge pull request #823 from Kuermel/master
...
Add more Options for XPackWatcherBackend (Elasticsearch)
2020-06-28 00:03:04 +02:00
de5e453e19
Merge pull request #831 from 404d/cbr-backend-tweaks
...
Add parentheses around field list groups in CB
2020-06-27 23:39:57 +02:00
825bda397d
desc: better descriptions in help for backends and configurations
2020-06-25 13:21:43 +02:00
203aa192c7
Fix multiple references to default field mapping in same rule
...
If there is a default mapping specified for a fieldmapping and that field is
referenced multiple times in the rule, the default mapping will be "pop"ped
and return the unmapped key on subsequent uses.
Don't pop the value. Just return the first entry.
2020-06-18 13:01:31 -04:00
f907c49ab5
Improved test coverage
...
* Added test case
* Removed unused code
2020-06-13 01:11:08 +02:00
bbcbed4742
Add parentheses about field list groups in CB
...
This should address the grouping issue from #660 .
The grouping issue was solved by just slamming some parentheses around the fields in the listExpression field.
2020-06-11 15:33:02 +02:00
915ea1cc67
Merge branch 'script_entry_points' into master
2020-06-10 00:51:47 +02:00
8c61dc9248
Add more Options for XPackWatcherBackend (Elasticsearch)
...
Add action_throttle_period, mail_from adn mail_profile to the XPackWatcherBackend (Elasticsearch)
2020-06-09 20:57:26 +02:00
dff7efc173
Update collection.py
2020-06-08 13:55:52 +02:00
55c0a03564
Undefined name: from .exceptions import SigmaCollectionParseError
...
Discovered in #378 . `SigmaCollectionParseError()` is called on line 55 but it is never defined or imported which means that NameError will be raised instead of SigmaCollectionParseError.
2020-06-08 13:55:16 +02:00
36a7077648
Moved tool executables to new location
2020-06-07 01:14:04 +02:00
a7d18c7ed9
Converted sigma2attack and added to entry points
2020-06-07 01:03:09 +02:00
7d70cd95a4
Deduplicated backend list
2020-06-06 01:03:02 +02:00
fb9855bd3b
Added description to es-rule backend
2020-06-06 01:02:44 +02:00
c992dc5215
Improved test coverage
2020-06-05 23:33:51 +02:00
5d88d97c73
Merge branch 'improvements/improved_mdatp_mappings' of https://github.com/wietze/sigma into wietze-improvements/improved_mdatp_mappings
2020-06-05 23:03:52 +02:00
3a6ac5bd5c
Remove unused function
2020-05-30 01:57:06 +02:00
70935d26ce
Add license header
2020-05-29 23:56:05 +02:00
dedfb65d63
Implemented Aggregation for SQL, Added SQLite FullTextSearch
2020-05-25 11:58:55 +02:00
daf7ab5ff7
Cleanup: removal of corelight_* backends
2020-05-24 22:41:38 +02:00
d45f8e19fe
Fixes
2020-05-24 21:46:55 +02:00
32e4998c49
Removed dead code from ALA backend.
2020-05-24 21:45:37 +02:00
24b08bbf30
Merge branch 'master' of https://github.com/socprime/sigma into socprime-master
2020-05-24 17:06:32 +02:00
2b72ee7b84
partial(?) fix of #762
2020-05-16 14:51:58 +03:00
2893becf8c
Merge remote-tracking branch 'upstream/master'
2020-05-14 14:02:20 +01:00
37b08543ac
Updated author reference in license
2020-05-11 11:47:56 +02:00
fb9c5841f4
Added Humio, Crowdstrike, Corelight
2020-05-08 13:41:52 +03:00
dc96b7ffb3
Removed dependency on slugify
2020-05-08 11:40:16 +02:00
c5be83eb01
Added ee-outliers backend
2020-05-08 10:18:35 +02:00
bar