blue-team-tools

Files

T

Thomas Patzke 849a5a520d Conditional field mapping resolve_fieldname now functional

Before this method just had some placeholder function that wasn't really
implementing the intended functionality of the conditional field
mapping. Now aggregations get also conditional field mapping
functionality.

2019-10-09 23:57:41 +02:00

config

create winlogbeat config/taxonomy specific to elastic enabled winlogbeat modules such as the one for sysmon](https://github.com/elastic/beats/blob/master/x-pack/winlogbeat/module/security/config/winlogbeat-security.js ) sigmac conversion

2019-10-01 10:16:42 -04:00

sigma

Conditional field mapping resolve_fieldname now functional

2019-10-09 23:57:41 +02:00

tests

Sigmatools release 0.12

2019-08-01 23:45:07 +02:00

merge_sigma

Fixes for parser split

2018-07-27 00:02:07 +02:00

README.md

Sigma tools release 0.11

2019-05-30 22:56:38 +02:00

requirements-devel.txt

Added requirements

2018-10-22 22:43:59 +02:00

requirements-misp.txt

Added requirements

2018-10-22 22:43:59 +02:00

requirements.txt

Intermediate refactoring commit: moving code into package

2017-12-08 21:45:05 +01:00

setup.cfg

Intermediate refactoring commit: moving code into package

2017-12-08 21:45:05 +01:00

setup.py

Fixed build

2019-08-05 23:42:33 +02:00

sigma2genericsigma

Increased indentation to 4

2019-03-02 00:14:20 +01:00

sigma2misp

Dropped .py suffix

2018-10-22 23:02:05 +02:00

sigmac

Improved --backend-config help text

2019-10-07 22:30:57 +02:00

README.md

This package contains libraries for processing of Sigma rules and the following command line tools:

sigmac: converter between Sigma rules and SIEM queries:
- Elasticsearch query strings
- Kibana JSON with searches
- Splunk SPL queries
- Elasticsearch X-Pack Watcher
- Logpoint queries
merge_sigma: Merge Sigma collections into simple Sigma rules.
sigma2misp: Import Sigma rules to MISP events.