4e895da471
fix error "has no len()"
2021-08-20 09:20:56 +02:00
7ba375dea0
Optimising lists/subexpressions with length 1
...
Should reduce brackets on some output targets
2021-08-11 18:00:09 +01:00
7923852cc3
Elastic: raise an error from the base backend if a rule has multiple conditions
2021-03-31 16:01:05 -04:00
daf7ab5ff7
Cleanup: removal of corelight_* backends
2020-05-24 22:41:38 +02:00
d45f8e19fe
Fixes
2020-05-24 21:46:55 +02:00
24b08bbf30
Merge branch 'master' of https://github.com/socprime/sigma into socprime-master
2020-05-24 17:06:32 +02:00
fb9c5841f4
Added Humio, Crowdstrike, Corelight
2020-05-08 13:41:52 +03:00
aa175a7d5b
wip
...
wip
2020-05-04 18:02:27 +01:00
dd9e128a15
kibana target update
...
kibana target now compatible with overrides
2020-05-04 17:35:12 +01:00
b3194e66c4
Update base.py
2020-05-04 16:37:36 +01:00
98391f985a
wip
...
wip
2020-04-30 15:19:38 +01:00
9ce84a38e5
overrides section support + one example rule + cloudtrail config
...
ditto
2020-04-29 20:36:45 +01:00
54c75167ce
Default configurations for backends
2019-11-03 23:32:50 +01:00
30948b9c1a
Added sigma-similarity tool
...
Fixed also bug in backend base class that was triggered by the way
backends are used by this tool.
2019-10-25 21:59:03 +02:00
805c739611
Merge branch 'devel-modifiers'
2019-07-31 23:44:10 +02:00
31c6ffcb61
No escaping for typed values
2019-07-31 23:43:29 +02:00
1bb29dca26
Implemented type modifiers and regular expressions
2019-07-15 22:52:10 +02:00
6bf010fb4b
introduce elastalert-dsl
...
(cherry picked from commit 0235ec23200e62766d9f21fbd26ed834991a0b61)
2019-05-27 17:18:19 +02:00
af0bd1b082
Removed debug code from backend option handling
...
Additionally: code simplification
2019-05-21 00:21:52 +02:00
eb022f3908
Conditional field mapping for null values
...
Fixes #326
2019-04-25 23:24:05 +02:00
d0bd8a2a41
Mandatory configuration for most backends
2019-04-22 23:40:21 +02:00
5e973a6321
Fixes and CI testing of --backend-config
2019-03-15 23:46:38 +01:00
0864d05aa5
Merge branch 'backend-config-file' of https://github.com/christophetd/sigma into christophetd-backend-config-file
2019-03-15 23:35:11 +01:00
3a7160d52b
Accept backend options from a configuration file ( closes #213 )
2019-02-23 13:20:20 +01:00
a9cf14438c
Merge branch 'master' into project-1
2019-01-14 22:36:15 +01:00
ffd43823cf
Fixed wildcard issue in es-qs backend and depending
...
See GitHub issue #194 . Fix for es-dsl is pending.
2018-12-19 00:33:12 +01:00
87aa1b5521
Move optimizer to sigma.parser.condition to enable it for all backends
2018-10-03 00:24:31 +02:00
cd3661b60c
Fix optimization of NOT corner cases
2018-10-02 22:48:33 +02:00
bed88cf813
Make uniq work for lists within definitions
2018-10-02 22:12:54 +02:00
7165128fa5
Remove None from AST - fixes None-related test failures
2018-10-02 21:44:37 +02:00
2242fc5ac8
Optimize the boolean expressions in the AST before generating output
...
Add code optimizing the boolean expressions in the abstract syntax tree
before generating output using the backend.
The main idea behind optimizing the AST is that less repeated terms is
generally better for backend performance. This is especially relevant
to backends that do not perform any query language optimization down
the road, such as those that generate code.
The following optimizations are currently performed:
- Removal of empty OR(), AND()
- OR(X), AND(X) => X
- OR(X, X, ...), AND(X, X, ...) => OR(X, ...), AND(X, ...)
- OR(X, OR(Y)) => OR(X, Y)
- OR(AND(X, ...), AND(X, ...)) => AND(X, OR(AND(...), AND(...)))
- NOT(NOT(X)) => X
A common example for when these suboptimal rules actually occur in
practice is when a rule has multiple alternative detections that are
OR'ed together in the condition, and all of the detections include a
common element, such as the same EventID.
This implementation is not optimized for performance and will perform
poorly on very large expressions.
2018-10-02 21:14:25 +02:00
1d7722c1cb
Added configuration and field mapping chains
...
Missing: field name mapping of log source conditions.
2018-08-27 00:17:27 +02:00
af9f636199
Removal of backend output classes
...
Breaking change: Instead of feeding the output class with the results,
they are now returned as strings (*Backend.generate()) or list
(SigmaCollectionParser.generate()). Users of the library must now take
care of the output to the terminal, files or wherever Sigma rules should
be pushed to.
2018-08-02 22:41:32 +02:00
df74460629
Fixed imports after config split
2018-07-27 23:54:18 +02:00
1c4c67053c
Fixes for parser split
...
* Fixed imports
* Rename
2018-07-27 00:02:07 +02:00
b76fa884ec
Changed copyright notices accordingly
2018-07-24 00:01:16 +02:00
c8e21b3f24
Fixing after split
...
* Fixing imports
* Discovery in new sub modules
2018-07-21 01:09:02 +02:00
d340487e94
Removal from sigma.backends.base
2018-07-10 23:44:14 +02:00
0c93040da5
Splitting backends - Copy base.py
2018-07-10 23:15:04 +02:00
frack113