valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

add selection flag for backward compatibility

Browse Source
This commit is contained in:
Theo Guidoux 2021-08-16 19:32:54 +02:00
parent c1876b9ff6
commit 2a3acd7d11
No known key found for this signature in database
GPG Key ID: AC97B26A222D0536
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
tools/sigma/backends/sql.py
View File

@ -46,7 +46,10 @@ class SQLBackend(SingleTextQueryBackend):
options = SingleTextQueryBackend.options + (
("table", "eventlog", "Use this option to specify table name.", None),
("select", "*", "Use this option to specify fields you want to select. Example: \"--backend-option select=xxx,yyy\"", None),
("selection", False, "Use this option to enable fields selection from Sigma rules.", None),
)
selection_enabled = False
def __init__(self, sigmaconfig, options):
@ -62,6 +65,9 @@ class SQLBackend(SingleTextQueryBackend):
else:
self.select_fields = list()
if "selection" in options:
self.selection_enabled = True
def generateANDNode(self, node):
generated = [ self.generateNode(val) for val in node ]
filtered = [ g for g in generated if g is not None ]
@ -162,13 +168,19 @@ class SQLBackend(SingleTextQueryBackend):
# Then add fields specified in the backend configuration
fields.extend(self.select_fields)
# In case select is specified in backend option, we want to enable selection
if len(self.select_fields) > 0:
self.selection_enabled = True
# Finally, in case fields is empty, add the default value
if not fields:
fields = list("*")
for parsed in sigmaparser.condparsed:
#query = self.generateQuery(parsed)
query = self._generateQueryWithFields(parsed, fields)
if self.selection_enabled:
query = self._generateQueryWithFields(parsed, fields)
else:
query = self.generateQuery(parsed)
before = self.generateBefore(parsed)
after = self.generateAfter(parsed)