0419ff215a
Fixed quoting of single quotes in grep backend
2019-04-01 23:22:05 +02:00
140a32d8c9
Sigma tools release 0.10
2019-03-16 01:02:48 +01:00
2dda9a7b77
Moved Sysmon schema XML from contrib directory into module
2019-03-16 00:59:29 +01:00
5e973a6321
Fixes and CI testing of --backend-config
2019-03-15 23:46:38 +01:00
0864d05aa5
Merge branch 'backend-config-file' of https://github.com/christophetd/sigma into christophetd-backend-config-file
2019-03-15 23:35:11 +01:00
3f7e08733a
Added backend option 'sysmon' for ala backend
2019-03-15 23:26:15 +01:00
8d1723e65c
Merge branch 'master' of https://github.com/tuckner/sigma into tuckner-master
2019-03-15 23:06:08 +01:00
a1ba04aec8
modified process creation logic
2019-03-08 00:01:43 -06:00
a429f09cc1
Merge branch 'elastalert-alert-types' of https://github.com/christophetd/sigma into christophetd-elastalert-alert-types
2019-03-07 23:54:05 +01:00
e9ddd933f8
more fixes for process creation
2019-03-07 16:28:35 -06:00
5a64f572e3
update
2019-03-07 10:32:59 -06:00
283bd278f4
added eventid to sysmon process creation
2019-03-05 20:58:23 -06:00
971bd49071
accomodated process creation and slash escapes
2019-03-05 20:50:30 -06:00
cf186387af
Added schema file checking
2019-03-04 11:53:51 -06:00
c5796d7853
Added Azure Log Analytics backend
2019-03-04 10:49:50 -06:00
8179d182c4
added azure log analytics
2019-03-04 10:44:45 -06:00
99b15edf8a
Sigma tools release 0.9
2019-03-02 00:47:03 +01:00
56a1ed1eac
Merge branch 'project-1'
2019-03-02 00:26:10 +01:00
7602309138
Increased indentation to 4
...
* Converted (to generic sigma) rules
* Converter outputs by default with indentation 4
2019-03-02 00:14:20 +01:00
690807c846
Sigma tools release 0.8
2019-02-28 09:08:22 +01:00
c922f7d73f
Merge branch 'master' into project-1
2019-02-26 00:24:46 +01:00
1a6faf385c
Add HTTP POST alert type to the Elastalert backend
2019-02-23 14:12:14 +01:00
3a7160d52b
Accept backend options from a configuration file ( closes #213 )
2019-02-23 13:20:20 +01:00
9ef314486e
Grep backend escapes +
2019-02-19 14:49:06 +01:00
004497075d
fix: spark source config bug
2019-02-12 23:27:38 +01:00
01dfc23a26
Merge pull request #234 from juju4/devel-sumo
...
Sumologic support update
2019-02-09 23:54:23 +01:00
5866d8eb71
Merge pull request #238 from sisecbe/patch-1
...
Adapt count function when aggfield not present
2019-02-09 23:38:20 +01:00
4429d7564f
remove 'escape' of '_' - not needed
2019-02-09 12:57:43 -05:00
a815b7eb9b
add custom cleanValue function for wildcards in keyvalue: OK with lists, NOK with string
2019-02-09 12:57:07 -05:00
046510f021
updated HELK Destination IP name
2019-02-05 13:11:06 -05:00
5d94b9f0bc
Changed stats to eventstats
...
Changed 'stats' to 'eventstats' when using aggregation, this keeps the original data of the event in the result.
2019-02-05 17:36:46 +01:00
2f5eb08b41
Adapt count function when aggfield not present
...
When no field is present, use "count" , when field is present use "dc(field)". As described in the Sigma specifications.
Splunk throws errors when using "count()" with empy fields. use "count" instead.
2019-02-05 15:44:05 +01:00
a276d3083d
DHCP log source in sigmac configs
2019-02-05 14:35:23 +01:00
7d159fb980
sumologic backend: review with inspiration from arcsight
2019-02-03 12:53:58 -05:00
6215a694a8
Remove escaping from '\\*' in es-dsl backend
2019-02-02 23:51:11 +01:00
8a0784ad33
Fixed escaping of \\*
2019-02-02 00:18:58 +01:00
516bfc88ff
Added rule: RDP login from localhost
2019-01-28 22:43:22 +01:00
3eaf83cf5a
Improved configurations
...
Added Security/4688 field mappings
2019-01-16 23:37:18 +01:00
ba64f485ac
Added generic Windows audit log configuration
2019-01-16 22:41:42 +01:00
4bc4c94a91
sigma2genericsigma: preserve dict order
2019-01-16 22:37:32 +01:00
2fd88c837d
Added generic sigma rule support to WDATP backend
...
* Process creation rules
2019-01-14 23:54:05 +01:00
4e83bfeb16
Fixed merge bugs
2019-01-14 22:54:26 +01:00
a9cf14438c
Merge branch 'master' into project-1
2019-01-14 22:36:15 +01:00
8336b47530
Merge branch 'master' of https://github.com/Neo23x0/sigma
2019-01-14 22:12:37 +01:00
cc4b806b94
Sigma tools release 0.7.1
2019-01-14 00:26:03 +01:00
5cba0b9946
Merge pull request #223 from m0jtaba/master
...
extending the qradar backend to allow for timeframe query
2019-01-13 23:55:55 +01:00
7634128143
Generate list of converted file in conversion to generic rules
2019-01-13 23:53:11 +01:00
e585858128
Optimization in conversion to generic rules
...
* only create necessary output files in directory output mode
* delete empty detections and empty detection sections
* Merge equal documents
* Merge reduced collections into one YAML document in common case
2019-01-13 23:45:11 +01:00
aa37ef2559
extending the qradar backend to allow for timeframe query
2019-01-11 03:33:49 +00:00
44f18db80d
Fix YAML errors reported by yamllint
...
Especially the config for ArcSight, that was invalid:
tools/config/arcsight.yml
89:5 error duplication of key "product" in mapping (key-duplicates)
90:5 error duplication of key "conditions" in mapping (key-duplicates)
rules/windows/builtin/win_susp_commands_recon_activity.yml
10:9 error too many spaces after colon (colons)
2019-01-10 09:51:39 +01:00
Thomas Patzke