8a545b973b
Sigmatools release 0.13
2019-10-21 11:58:26 +02:00
fc276612b6
Added encoding modifiers
2019-10-16 23:52:06 +02:00
6a1a96a918
Implement mapping when selecting the fields for the AQL query. This was not being done correctly
2019-10-16 16:37:09 +02:00
2837d3ba74
Added the cleanValue function for Qradar
2019-10-16 10:27:24 +02:00
849a5a520d
Conditional field mapping resolve_fieldname now functional
...
Before this method just had some placeholder function that wasn't really
implementing the intended functionality of the conditional field
mapping. Now aggregations get also conditional field mapping
functionality.
2019-10-09 23:57:41 +02:00
95c8d25858
Improved --backend-config help text
2019-10-07 22:30:57 +02:00
a729cc7905
create winlogbeat config/taxonomy specific to elastic enabled winlogbeat modules such as the one for sysmon]( https://github.com/elastic/beats/blob/master/x-pack/winlogbeat/module/security/config/winlogbeat-security.js ) sigmac conversion
2019-10-01 10:16:42 -04:00
f7fd936433
update HELK config taxonomy/mapping for sigmac conversion
2019-10-01 10:14:54 -04:00
d4f89ebc1c
Aggregation on keyword field in es-dsl backend
...
* Fixes #452
* Further fixed reference to count in restriction of results
2019-09-29 23:18:17 +02:00
3d333290a9
Merge pull request #445 from EccoTheFlintstone/localadmin
...
rule: user added to local administrator: handle non english systems b…
2019-09-25 17:29:41 +02:00
19f431b6d2
Changed xpack-watcher dateField default to previous value
2019-09-12 00:19:58 +02:00
4c5eab88b6
add GroupSid to other configs
2019-09-11 04:53:30 -04:00
8f612f743c
Use config dateField in xpack watcher to determine
...
datefield name as in elasticsearch dsl backend
2019-09-11 09:38:03 +02:00
5ae46ac56d
rule: user added to local administrator: handle non english systems by using group sid instead of name
2019-09-06 06:21:42 -04:00
c80cb418cd
Improved QRadar regular expression support
2019-09-05 15:35:26 +02:00
30b6db8299
Fixed ES backend keyword field mapping wildcard match pattern
2019-09-05 12:55:10 +02:00
3b1cbe529e
Elasticsearch keyword field name blacklisting with wildcards
2019-09-05 12:38:32 +02:00
2a60c71b9d
Merge pull request #437 from svent/qradar_regex_modifier
...
QRadar backend: add support for re type modifiers
2019-09-05 10:30:18 +02:00
de5e2045f0
Merge pull request #428 from stevengoossensB/master
...
AQL field selection from signatures
2019-09-05 10:28:02 +02:00
37e179b6a7
Merge pull request #390 from juju4/devel-sumo2
...
sumologic backend: fix index and full mapping coverage
2019-09-05 10:27:19 +02:00
467c8f694c
QRadar backend: add support for re type modifiers
2019-09-03 22:55:48 +02:00
cb088e4911
Remove quotes from around the fields to make the query semantically correct
2019-08-26 12:43:26 +00:00
ad19f05e2c
Include mapped names rather then signature names
2019-08-26 12:06:20 +00:00
37caccd52e
Includes the trial condition so generic query is generated whenever the fields are not defined
2019-08-26 11:48:40 +00:00
895682aef2
Implementing the fields to be selected
2019-08-26 10:57:43 +00:00
0984293d0c
Support for Malicious cmdlets in ATP
2019-08-20 14:33:08 -07:00
1ea6d00a39
Fix QRadar field name escaping and handling
2019-08-12 23:47:43 +02:00
826c1e3942
Fix QRadar backend config
2019-08-12 23:47:43 +02:00
0708fdd28e
Correctly escape slashes within es-dsl wildcard queries
2019-08-07 12:56:19 +02:00
9c85d5e80f
Merge pull request #406 from tuckner/master
...
Fix ala parsing issues
2019-08-06 10:28:07 +02:00
940c36a4cd
Fixed build
...
Missing package specification
2019-08-05 23:42:33 +02:00
d5885686fc
Sigmatools release 0.12
...
* Value modifiers
* Config name cleanup
2019-08-01 23:45:07 +02:00
805c739611
Merge branch 'devel-modifiers'
2019-07-31 23:44:10 +02:00
31c6ffcb61
No escaping for typed values
2019-07-31 23:43:29 +02:00
8f2f1922c6
Merge pull request #1 from Neo23x0/master
...
update fork
2019-07-27 21:27:52 -05:00
8a3117d73e
Nested list handling for chained value modifiers
2019-07-16 23:03:19 +02:00
6881967889
Further modifiers
...
* base64
* base64offset
2019-07-16 00:00:35 +02:00
1bb29dca26
Implemented type modifiers and regular expressions
2019-07-15 22:52:10 +02:00
b9ff280209
Cleanup of configuration names
2019-07-14 00:50:15 +02:00
5489f870cc
Merge pull request #393 from HacknowledgeCH/master
...
Explicit OR for list elements
2019-07-13 23:11:44 +02:00
134bfebe57
Ignore "timeframe" detection keyword in "all/any of" conditions
...
Fixes #395
2019-07-13 00:35:35 +02:00
576912eb7a
Support OR queries for Elasticsearch 6 and above
2019-07-08 17:12:53 +02:00
10290beb54
config/sumologic: more index mappings
2019-07-06 12:42:12 -04:00
7b0cace217
config/sumologic: more index mappings
2019-07-06 12:42:05 -04:00
2b5a77db53
add sumologic _sourceCategory and _view in aFL
2019-07-06 12:41:56 -04:00
b358d38e68
_index in aFL and mappings working!
2019-07-06 12:41:40 -04:00
f7ba2b3976
fix: bug in sumologic backend with 'null' values
2019-07-02 22:31:10 +02:00
337681cfce
Value modifiers
...
* First transformation modfiers: contains, all
* Sigma converter modifier list
2019-06-30 23:41:28 +02:00
161965d14c
Added version information to Winlogbeat configs
2019-06-30 22:44:12 +02:00
74021d53d8
Modified winlogbeat config to adhere to winlogbeat 7 field names breaking changes
...
ref: https://www.elastic.co/guide/en/beats/libbeat/current/breaking-changes-7.0.html
2019-06-30 12:13:21 +02:00
Thomas Patzke