 Thomas Patzke
|
a25b2ec361
|
Merge pull request #523 from refractionPOINT/lc-added-mtd
LC added FP metadata
|
2019-12-13 21:50:52 +01:00 |
|
|
Thomas Patzke
|
b701e9be50
|
Added ECS proxy configuration
|
2019-12-09 16:34:07 +01:00 |
|
|
Thomas Patzke
|
991108e64d
|
Further proxy field name fixes (config + rules)
|
2019-12-07 00:23:30 +01:00 |
|
|
Thomas Patzke
|
51e9689425
|
Sigmatool release 0.15.0
|
2019-12-06 22:13:44 +01:00 |
|
|
Maxime Lamothe-Brassard
|
27bb07b74e
|
Adding support for basic proxy rules using the HTTP_REQUEST events from the Chrome LC Agent.
|
2019-12-05 09:35:09 -08:00 |
|
|
Lep
|
60997b47b2
|
moreEventID
|
2019-11-28 21:34:52 +07:00 |
|
|
Lep
|
412dfc4f05
|
Merge branch 'master' of http://git.security.fis.vn/VuNX2/sigma
|
2019-11-28 17:38:57 +07:00 |
|
|
Lep
|
738008b52b
|
requiment
|
2019-11-28 17:38:05 +07:00 |
|
|
Nguyen Xuan Vu
|
042d078ee1
|
Update requirements.txt
|
2019-11-28 05:26:09 -05:00 |
|
|
Lep
|
158ffd2f0c
|
requiment
|
2019-11-28 17:23:05 +07:00 |
|
|
Lep
|
37257170dd
|
postAPI
|
2019-11-28 16:01:24 +07:00 |
|
|
Lep
|
d08ff35222
|
postAPI
|
2019-11-28 11:45:49 +07:00 |
|
|
Maxime Lamothe-Brassard
|
61bcc46394
|
Prettier formatting of YAML.
|
2019-11-18 14:50:41 -05:00 |
|
|
Maxime Lamothe-Brassard
|
9eed57ee1d
|
Adding the "falsepositives" field to the LC metadata.
|
2019-11-15 08:30:41 -05:00 |
|
|
Anastasios Zouzias
|
3c7f522017
|
add .keyword on aggs; add extra unit test
|
2019-11-14 14:34:50 +01:00 |
|
|
Thomas Patzke
|
cf22e9e576
|
Added hint on failed UUID check
|
2019-11-12 23:37:28 +01:00 |
|
|
Thomas Patzke
|
ca53e937d9
|
Removed sigma.output from setup packages
|
2019-11-12 23:11:39 +01:00 |
|
|
Thomas Patzke
|
3828f4a95c
|
Merge branch 'uuid' into assign-ids
|
2019-11-12 22:46:54 +01:00 |
|
|
Thomas Patzke
|
0065e2420f
|
Merge branch 'oscd-qa'
|
2019-11-12 20:54:11 +01:00 |
|
|
Anastasios Zouzias
|
e7ed0fa9ea
|
added unit test
|
2019-11-12 14:06:10 +01:00 |
|
|
Anastasios Zouzias
|
324005a126
|
[feature] extend es-dsl to support nested aggregations
|
2019-11-12 11:46:43 +01:00 |
|
|
Thomas Patzke
|
6d62d426c9
|
Added sigma-uuid tool
* Moved SigmaYAMLDumper to new sigma.output module
|
2019-11-11 23:35:16 +01:00 |
|
|
Florian Roth
|
e2628d6df6
|
fix: wrong mapping on thor.cfg
|
2019-11-11 09:20:20 +01:00 |
|
|
Thomas Patzke
|
feb836cbf2
|
Sigmatools release 0.14
|
2019-11-10 00:09:59 +01:00 |
|
|
Florian Roth
|
faeccf0c3d
|
Merge branch 'master' into devel
|
2019-11-09 22:42:16 +01:00 |
|
|
Florian Roth
|
a0beda240c
|
fix: fixed wrong field mapping in windows-audit source config
|
2019-11-09 22:42:00 +01:00 |
|
|
Thomas Patzke
|
2222550b6e
|
Allow ignore of type errors with sigmac -I
|
2019-11-08 23:56:39 +01:00 |
|
|
Thomas Patzke
|
8f1974d7d3
|
Added regular expression support in es-dsl backend
|
2019-11-08 23:56:39 +01:00 |
|
|
Thomas Patzke
|
465e41bfbb
|
Added regular expression support in es-dsl backend
|
2019-11-08 22:31:02 +01:00 |
|
|
Thomas Patzke
|
5d995ad704
|
sigma-similarity: primary rule set for restriction of comparison
|
2019-11-08 21:15:13 +01:00 |
|
|
Thomas Patzke
|
ef14ee542d
|
Added modifiers: startswith and endswith
|
2019-11-05 23:04:13 +01:00 |
|
|
Maxime Lamothe-Brassard
|
1b9054c1f3
|
Adding some comments
|
2019-11-05 08:39:24 -05:00 |
|
|
Maxime Lamothe-Brassard
|
b7018bcd4a
|
Adding a post-mapper mechanism to fix some common issues in Sigma rules to LC.
|
2019-11-05 08:39:24 -05:00 |
|
|
Maxime Lamothe-Brassard
|
c2e621cf08
|
Fixing another edge case with string escape.
|
2019-11-05 08:39:24 -05:00 |
|
|
Maxime Lamothe-Brassard
|
0c6b9e532b
|
Remove debugging statement
|
2019-11-05 08:39:24 -05:00 |
|
|
Maxime Lamothe-Brassard
|
6f2f1d2bd7
|
Add ability to map fields and values based on callbacks.
|
2019-11-05 08:39:24 -05:00 |
|
|
Maxime Lamothe-Brassard
|
0b9a3f3a08
|
Refactor to better support keyword fields.
|
2019-11-05 08:39:24 -05:00 |
|
|
Maxime Lamothe-Brassard
|
9aedb8f764
|
Adding another exception case to get more "contains" shortcuts instead of REs.
|
2019-11-05 08:39:24 -05:00 |
|
|
Maxime Lamothe-Brassard
|
102ab3081b
|
Fix the convertion from simple wildcard strings to a full regular expression so that it is always correct. The previous solution just mostly-worked.
|
2019-11-05 08:39:24 -05:00 |
|
|
Maxime Lamothe-Brassard
|
e52f29dda9
|
Fix matches operator field set to value instead of re.
|
2019-11-05 08:38:06 -05:00 |
|
|
Thomas Patzke
|
54c75167ce
|
Default configurations for backends
|
2019-11-03 23:32:50 +01:00 |
|
|
Thomas Patzke
|
4f19ef5708
|
Graylog backend now derived from es-qs
Technically, Graylog is ES. Fixes and improvements for ES didn't
propagate to Graylog, now they do.
|
2019-11-02 22:56:01 +01:00 |
|
|
Thomas Patzke
|
8af2b70594
|
Restrict search not bound to fields to keyword fields
|
2019-11-02 22:55:04 +01:00 |
|
|
Thomas Patzke
|
c9eb921f68
|
ConditionAND/OR constructor now allows arbeitrary number of operands
|
2019-11-02 22:54:35 +01:00 |
|
|
Thomas Patzke
|
2eeccf48e0
|
Removed line breaks in Elastalert YAML output
Fixes #453
|
2019-10-29 22:45:37 +01:00 |
|
|
Maxime Lamothe-Brassard
|
f6fb9c7f5f
|
Fixing typo in response metadata.
|
2019-10-28 11:31:50 -05:00 |
|
|
Maxime Lamothe-Brassard
|
2873e1ded3
|
Small refactors to make more readable and remove deprecated code paths to increase coverage.
|
2019-10-28 10:49:05 -05:00 |
|
|
Maxime Lamothe-Brassard
|
a7003c2aa3
|
Adding support for "unix", looking like a mistake by the creator.
|
2019-10-27 15:55:12 -05:00 |
|
|
Maxime Lamothe-Brassard
|
d019cef439
|
Ading a bit more of early support for netflow and some linux exe.
|
2019-10-27 15:48:28 -05:00 |
|
|
Maxime Lamothe-Brassard
|
a57a7b58cf
|
Added conceptial support for aliasing keyworkds to a specific field depending on the log source.
|
2019-10-27 15:28:54 -05:00 |
|