065bcd8018
Refresh ATT&CK data to v7.2 and expand threat validation ( #330 )
...
* refresh to latest ATT&CK 7.2
* add new unit test to further validate threat mappings
* updated threat mappings in rules to reflect changes
* new func to download and refresh mitre data based on version
2020-09-23 22:03:29 -08:00
9d22970e21
Add EQL rules and schema validation ( #297 )
...
* Add EQL rules and schema validation
* Lint nitpick
* Rename get_schema_from_eql
* Add EQL default language
* Rename parsed_kql to parsed_query
* Fix parsed_kql method call in loader
* Autopopulate dependent values
2020-09-16 08:36:48 -06:00
464d5e645a
Fix kibana-upload and remove cumbersome dataclasses ( #216 )
...
* Fix kibana-upload and remove cumbersom dataclasses
* Linting fixes
2020-09-01 05:47:27 -06:00
d15da0ada1
Add versioned schemas with a downgrade path ( #84 )
...
* Add versioned schemas with a downgrade path
* Remove and move unused variables
* Add missing license
* Skip NotField for output_index
* Add strip_additional_properties for kibana import
* Remove stray comment
* Apply suggestions from code review
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-07-23 11:39:35 -06:00
5f867dbb72
Add KQL -> DSL conversion ( #81 )
...
* Add KQL -> DSL converter
* Lint with black to 120 chars
* Add more tests and flatten shoulds
* Fix NotValue conversion to DSL
2020-07-22 11:05:45 -06:00
4fe3aaff1a
Add test for duplicate file names ( #34 )
2020-07-08 14:00:28 -06:00
e2d97b0a74
Remove unreachable and legacy code
...
Co-Authored-By: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-06-30 10:12:23 -06:00
d51474f0a7
Add unit tests
...
Co-Authored-By: Justin Ibarra <brokensound77@users.noreply.github.com >
2020-06-29 23:19:25 -06:00
Justin Ibarra