valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 17:35:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix YAML errors reported by yamllint

Browse Source 
Especially the config for ArcSight, that was invalid:

    tools/config/arcsight.yml
      89:5      error    duplication of key "product" in mapping  (key-duplicates)
      90:5      error    duplication of key "conditions" in mapping  (key-duplicates)

    rules/windows/builtin/win_susp_commands_recon_activity.yml
      10:9      error    too many spaces after colon  (colons)
This commit is contained in:
Adrien Vergé 2019-01-10 09:47:33 +01:00
parent b5531be4bf
commit 44f18db80d
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/windows/builtin/win_susp_commands_recon_activity.yml
View File

@ -7,7 +7,7 @@ references:
- https://twitter.com/haroonmeer/status/939099379834658817
- https://twitter.com/c_APT_ure/status/939475433711722497
- https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html
author: Florian Roth, Markus Neis
author: Florian Roth, Markus Neis
date: 2018/08/22
modified: 2018/12/11
tags:

2
tools/config/arcsight.yml
View File

@ -85,7 +85,7 @@ logsources:
conditions:
deviceProduct: Apache
categoryDeviceGroup: /Application
firewall:
firewall:
product: firewall
conditions:
categoryDeviceGroup: /Firewall