4e3b275056
Fix more windows fields name
2021-07-07 12:28:00 +02:00
5c9ca35bb6
Add the last missing
2021-07-07 09:10:50 +02:00
e76f30d59c
Add some missing fields mapping
2021-07-06 15:56:33 +02:00
400fae4dba
Merge pull request #1609 from cianmcgovern/graylog-fix
...
Escape spaces in graylog backend
2021-07-04 14:20:07 +02:00
8fd81acee4
Change getRuleName() to get 'id-title' instead of ('id' or 'title')
2021-07-04 11:56:59 +02:00
7fca08e5bd
Escape spaces in graylog backend
2021-07-02 21:56:08 +01:00
06ab553d25
Merge pull request #1604 from SigmaHQ/rule-devel
...
Config: Splunk fix log sources prefix, THOR PS classic
2021-07-02 15:39:22 +02:00
ba94b8396c
config: thor - powershell classic
2021-07-02 14:14:48 +02:00
03e2b9d376
fix: missing "WinEventLog:" in splunk-windows.yml
2021-07-02 14:13:12 +02:00
825ff5520b
Merge pull request #1597 from SigmaHQ/rule-devel
...
config: add PrintService Operational
2021-07-01 10:27:43 +02:00
63f3fd7e73
config: add PrintService Operational
2021-07-01 09:55:15 +02:00
19962c6fe4
Merge pull request #1590 from SigmaHQ/rule-devel
...
config: mappings for Microsoft print service
2021-06-30 14:50:52 +02:00
a49bfb14dd
refactor: Admin log - not Operational
2021-06-30 14:22:40 +02:00
26cfbb9c34
config: mapping for Microsoft SMBClient service - security
2021-06-30 14:16:26 +02:00
8262a1d98b
config: mappings for Microsoft print service
2021-06-30 14:09:44 +02:00
abe353de66
Merge pull request #1561 from frack113/es_rule_add_more_tag
...
add multi custom tag for issue #1560
2021-06-25 12:25:28 +02:00
2ad6401487
Merge pull request #1565 from SpeedyFireCyclone/powershell_fieldmappings
...
Generic remapping for PowerShell backend
2021-06-25 12:21:00 +02:00
537d89d185
Merge pull request #1575 from SigmaHQ/rule-devel
...
rules: PurpleSharp, WMIC ActiveScriptEventConsumer
2021-06-25 12:15:35 +02:00
bfbd1c6487
Merge remote-tracking branch 'upstream/master' into master
2021-06-21 14:11:39 +02:00
4b92dbb90d
master: Added new Devo backend for the sigmac tool. Added three new backend configurations to support the Devo backend. Added a new test suite to cover the Devo backend cases.
2021-06-21 14:06:04 +02:00
a18c3952d9
More generic remapping for PowerShell backend
2021-06-20 07:58:01 +02:00
1f2c93a4e7
add multi custom tag for issue #1560
2021-06-17 08:05:44 +02:00
ae06ebcae0
Merge pull request #1551 from xg5-simon/xg5-simon
...
Support for VMware Carbon Black Cloud EEDR
2021-06-10 18:35:16 +02:00
bf40b64f91
docs: better title in crowdstrike config
2021-06-10 17:07:01 +02:00
cd2792f82c
Merge pull request #1547 from frack113/new_filter_condition
...
Add New filter condition
2021-06-10 14:42:44 +02:00
1d081e300d
Support for VMware Carbon Black Cloud EEDR
...
Add support for VMware Carbon Black Cloud EEDR. Field mappings derived from https://developer.carbonblack.com/reference/carbon-black-cloud/cb-threathunter/latest/process-search-fields/
2021-06-10 21:45:29 +10:00
ab3baa9463
Merge pull request #1534 from SpeedyFireCyclone/mdatp_serviceinstalled
...
MDATP ServiceInstalled mapping
2021-06-10 09:05:56 +02:00
a600e2dcaa
forget a print debug
2021-06-10 08:49:15 +02:00
af1aee9541
Add filter condition= and condition!=
2021-06-10 08:26:19 +02:00
1b4d4cfb82
Add missing sysmon EventID
2021-06-09 12:52:38 +02:00
2034d36677
Add support for Elastic EQL
...
The EQL backend supports translation of the "near" aggregation into
EQL sequences. Additionally, the es-rule backend now has a sibling
es-rule-eql backend that outputs EQL queries instead of qs.
2021-06-08 13:38:38 -04:00
e66a3f9513
T1562.001 Attempting to disable scheduled scanning and other parts of windows defender atp.
2021-06-07 15:03:19 +02:00
3d9fe490ab
Detect modification of sysmon configuration by sysmon
2021-06-04 11:27:15 +02:00
0aa05f53e9
MDATP ServiceInstalled event mapping
2021-06-03 21:43:52 +02:00
2115bfcd75
Merge pull request #1519 from frack113/esrule_new_option
...
Add some fun backend option for es-rule
2021-06-03 20:50:44 +02:00
bf98f43850
Set powershell_alternate_powershell_hosts.yml more accurate by adding the correct channel for EventID
2021-06-01 10:47:17 +02:00
aa34ff8e3c
Addition of System channel for more accurate detection
2021-05-30 09:27:08 +02:00
7ec513f1d0
Fix error when use -< namefile.yml in commandline as I never use it
2021-05-28 12:47:37 +02:00
b3a608599a
Add some fun backend option for es-rule
2021-05-28 10:51:08 +02:00
6e31bc3037
Merge pull request #1485 from V1D1AN/master
...
Update ecs-zeek-elastic-beats-implementation.yml
2021-05-27 14:59:14 +02:00
ffeda2a2a2
Merge pull request #1492 from frack113/es_rule_uuid
...
Fix errors when import es-rule ndjson to KIBANA
2021-05-27 10:24:39 +02:00
f98716c672
Merge pull request #1500 from frack113/sigmac_add_time_filter
...
Sigmac add new filter
2021-05-27 10:16:19 +02:00
d06f2bcf14
fix: sysmon backend "startswith"
2021-05-26 15:42:16 +02:00
bb71860fb2
Merge pull request #1509 from vastlimits/feature/update-6.1
...
Updated uberAgent backend to support version 6.1.
2021-05-26 13:08:08 +02:00
0e688d8dd0
Add the 'logsource!=' filter
2021-05-22 09:04:30 +02:00
f213226eb4
Add the 'tag!=' filter
2021-05-22 08:57:42 +02:00
8aa3ea15d7
change to the more revealing name "inlastday"
2021-05-22 08:44:30 +02:00
8a8f003d15
add lastday filter to get only the rule update or create in the last N days
...
lastday=0 is all :)
2021-05-21 19:31:06 +02:00
b92b765f9a
Fix import to kibana error 400 severity is invalid.
2021-05-20 13:14:43 +02:00
cbb81cdf86
Fix import to kibana error 400 rish_score is null.
...
rish_score is a integer.
If level is invalid set to medium
2021-05-20 12:32:19 +02:00
frack113