juju4
10290beb54
config/sumologic: more index mappings
2019-07-06 12:42:12 -04:00
juju4
7b0cace217
config/sumologic: more index mappings
2019-07-06 12:42:05 -04:00
juju4
2b5a77db53
add sumologic _sourceCategory and _view in aFL
2019-07-06 12:41:56 -04:00
juju4
b358d38e68
_index in aFL and mappings working!
2019-07-06 12:41:40 -04:00
Florian Roth
f7ba2b3976
fix: bug in sumologic backend with 'null' values
2019-07-02 22:31:10 +02:00
Thomas Patzke
161965d14c
Added version information to Winlogbeat configs
2019-06-30 22:44:12 +02:00
herrBez
74021d53d8
Modified winlogbeat config to adhere to winlogbeat 7 field names breaking changes
...
ref: https://www.elastic.co/guide/en/beats/libbeat/current/breaking-changes-7.0.html
2019-06-30 12:13:21 +02:00
Thomas Patzke
6fab5d7f23
Improved testing and removed dead&debug code
2019-06-29 00:09:53 +02:00
Thomas Patzke
377872c91e
Merge branch 'devel-sumo' of https://github.com/juju4/sigma into juju4-devel-sumo
2019-06-28 23:39:15 +02:00
Thomas Patzke
0c7151c901
Watcher backend default options, refactoring and testing
2019-06-28 23:22:16 +02:00
Adrian Constantin Stanila
feac0be8a4
Added 2 more actions on Elasticsearch X-pack Watcher: index and webhook
...
Added timestamp filter query.
2019-06-27 08:54:59 +03:00
juju4
654a009c9e
sumologic backend: remove TypeError
2019-06-22 16:49:46 -04:00
juju4
559d0f4ba8
sumologic backend: force as string
2019-06-22 16:43:50 -04:00
juju4
2df0e9765c
sumologic backend: pycodestyle review - E501
2019-06-22 16:41:57 -04:00
juju4
49533a5909
sumologic backend: pycodestyle review
2019-06-22 16:39:13 -04:00
juju4
84de12635e
self.debug option, fix multiple keyvalue escapings/cleanValue, inline index for now
2019-06-22 16:19:45 -04:00
juju4
a11d800353
Merge branch 'master' into devel-sumo
2019-06-22 09:18:23 -04:00
Thomas Patzke
f4da0c5540
Added field SecurityID to Winlogbeat config
2019-06-19 23:35:50 +02:00
Thomas Patzke
f271685f59
Merge pull request #372 from dvas0004/patch-2
...
Addition of KeyLength field
2019-06-19 23:28:31 +02:00
Thomas Patzke
d82df83ef1
Merge pull request #369 from TareqAlKhatib/refactors
...
Refactors
2019-06-19 23:16:19 +02:00
David Vassallo
fdce7ad9bf
Addition of KeyLength field
2019-06-14 17:58:47 +03:00
Thomas Patzke
5715413da9
Usage of Channel field name in ELK Windows config
2019-06-11 13:15:43 +02:00
Tareq AlKhatib
d61a971874
Minor refactors
2019-06-10 09:55:52 +03:00
Thomas Patzke
8a0f706cca
Merge branch 'master' of https://github.com/Neo23x0/sigma
2019-05-30 23:24:37 +02:00
Thomas Patzke
1986bcb843
Sigma tools release 0.11
2019-05-30 22:56:38 +02:00
Thomas Patzke
673973e523
Merge pull request #357 from agix/es_dsl_bug
...
fix missing condition when unique plus timeframe
2019-05-30 22:42:09 +02:00
Thomas Patzke
8023011bb1
Merge branch 'elastalert_dsl_backend' of https://github.com/agix/sigma into agix-elastalert_dsl_backend
2019-05-30 22:33:57 +02:00
Florian GAULTIER
89c1d7b63d
Wrong fix, self.queries should be emptied after copied to rule_object
2019-05-29 16:10:14 +02:00
Florian GAULTIER
748ac2e206
Dont combine multiple queries
2019-05-29 16:05:53 +02:00
Thomas Patzke
04d91573f3
Merge pull request #355 from agix/allow_empty_keyword
...
Allow empty keyword_field
2019-05-28 21:45:55 +02:00
Thomas Patzke
2ecc55c13f
Merge pull request #351 from ipninichuck/master
...
added metadata field to the watcher alert
2019-05-28 21:42:27 +02:00
Florian GAULTIER
d866e75750
Be sure there is a key in the single condition
2019-05-27 17:27:16 +02:00
Florian GAULTIER
e8a7c5f7b9
fix missing condition when unique plus timeframe
2019-05-27 17:22:28 +02:00
Florian GAULTIER
6bf010fb4b
introduce elastalert-dsl
...
(cherry picked from commit 0235ec23200e62766d9f21fbd26ed834991a0b61)
2019-05-27 17:18:19 +02:00
Florian GAULTIER
4168c0ec64
Allow empty keyword_field
2019-05-27 15:08:33 +02:00
Thomas Patzke
36ba9f78da
Improved message if configuration is missing
2019-05-27 13:18:36 +02:00
Thomas Patzke
84690280c5
Improved behavior on missing configuration
...
Listing all configus usable with chosen backend
2019-05-24 22:41:47 +02:00
ipninichuck
75ec169d5c
added metadata field to the watcher alert
...
While utilizing Kibana to track watches directly from the watch index it became quickly apparent that useful metadata was not available. In my project's case it was the title, description and tags from the sigma rule. By adding them to the metadata field it makes it easier to utilize them in visualizations of the watches themselves. In the future perhaps the contents of the metadata field could be given as an option for each user.
2019-05-22 04:30:47 -07:00
Thomas Patzke
194afa739f
Generate rule name for each condition
...
In backends kibana and xpack-watcher.
Fixes #329
2019-05-21 00:36:19 +02:00
Thomas Patzke
af0bd1b082
Removed debug code from backend option handling
...
Additionally: code simplification
2019-05-21 00:21:52 +02:00
Thomas Patzke
97541ac267
Added -C shortcut for --backend-config
2019-05-21 00:15:01 +02:00
Thomas Patzke
7e163d71eb
Added option to use old URL in xpack-watcher backend
2019-05-21 00:01:21 +02:00
Thomas Patzke
4e63e925cf
Merge branch 'patch-1' of https://github.com/lliknart/sigma into lliknart-patch-1
2019-05-20 23:43:49 +02:00
Thomas Patzke
11ed7e7ef8
Check for valid configuration/backend combinations
2019-05-20 01:00:33 +02:00
Thomas Patzke
e271484eef
Load configurations via new config management
2019-05-20 00:27:35 +02:00
Thomas Patzke
3d20e0bc98
Sigma configuration management with listing
...
Missing:
* Use config by identifier
2019-05-17 09:13:59 +02:00
Thomas Patzke
71ff6bd943
Catch type errors in configuration handling
2019-05-16 23:34:44 +02:00
Thomas Patzke
36aeb19721
Added title to all configurations
2019-05-16 23:33:51 +02:00
lliknart
f86342012a
Update elasticsearch.py
...
From ElasticSearch 7.0, the URI to access to Watcher API changes
Deprecation: [PUT /_xpack/watcher/watch/{id}] is deprecated! Use [PUT /_watcher/watch/{id}] instead.
2019-05-16 16:17:57 +02:00
Florian Roth
a6d2a5d79b
fix: more general fixes of the var type issue
2019-05-15 21:25:53 +02:00
