58 Commits

Author	SHA1	Message	Date
Florian Roth	f66085b198	Added eventlog source DNS Server to configs	2017-05-08 13:09:17 +02:00
Thomas Patzke	05e9d1e1e9	Check if aggregation is present in BaseBackend ... Caused NotImplementedError in ElasticsearchQueryStringBackend.	2017-04-17 00:11:20 +02:00
Ben de Haan	dddb83393d	Added field mappings for events with logins	2017-03-30 10:49:36 +02:00
Ben de Haan	cb9a9bc2ff	Added LogPoint conditional username mapping ... Conditional mapping of SubjectAccountName based on EventID. Not a comprehensive list, but should include most relevant Event IDs.	2017-03-30 09:51:32 +02:00
Thomas Patzke	c43166d5b9	Fixed log source configuration matching	2017-03-29 23:33:26 +02:00
Thomas Patzke	a22fe58ac9	Aggregation support for Splunk backend	2017-03-29 23:18:47 +02:00
Thomas Patzke	b62de742d7	Aggregation expression parsing	2017-03-29 23:17:43 +02:00
Thomas Patzke	ae5ae8f763	Verbose mode prints tokens if parsing failed	2017-03-29 22:21:40 +02:00
Thomas Patzke	9698e8fdf7	Changed Logpoint SubjectAccountName mapping to conditional mapping	2017-03-25 00:27:29 +01:00
Thomas Patzke	c978e19d88	Conditional field mappings	2017-03-25 00:21:44 +01:00
Thomas Patzke	a4465ce844	Added 1:n field mapping ... MultiFieldMapping	2017-03-24 00:58:11 +01:00
Thomas Patzke	5009794591	Changes to field mappings ... * Introduced field mapping objects * moved mapping from backends into parse tree generation (SigmaParser.parse_definition)	2017-03-24 00:48:32 +01:00
Florian Roth	7e180365ab	PowerShell Classic Log in Splunk Config Example	2017-03-22 11:17:46 +01:00
Ben de Haan	c3c405a95e	LogPoint windows mapping	2017-03-20 16:57:19 +01:00
Thomas Patzke	1bf11dc471	Merge pull request #17 from benno001/master ... Fixed LogPoint list behaviour	2017-03-20 08:58:16 +01:00
Ben de Haan	c94b539b14	Fixed LogPoint list behaviour	2017-03-20 08:41:29 +01:00
Thomas Patzke	d0bed75eb9	Added --output/-o parameter to sigmac	2017-03-18 23:15:03 +01:00
Florian Roth	f34156138f	Bugfix - Index	2017-03-18 13:57:42 +01:00
Florian Roth	8403e8072c	Merge pull request #14 from benno001/master ... Added LogPoint backend	2017-03-18 13:30:35 +01:00
Florian Roth	f292a259a5	Adjusted Windows Splunk Config	2017-03-18 13:12:31 +01:00
Ben de Haan	d18751a0ea	Added LogPoint backend	2017-03-18 11:12:06 +01:00
Thomas Patzke	17c484163d	Improved examples	2017-03-18 00:03:21 +01:00
Thomas Patzke	b4f52d9cfb	Windows index in Splunk example configuration	2017-03-17 23:30:11 +01:00
Thomas Patzke	b865a858aa	Generation of conditions for configured indices	2017-03-17 23:28:06 +01:00
Florian Roth	dc00baacda	Splunk Windows Configuration Example	2017-03-17 10:00:56 +01:00
Thomas Patzke	d2a9a91175	Log source conditions are integrated in generated expressions ... Indices not yet included	2017-03-14 23:22:32 +01:00
Thomas Patzke	52d7e9fc07	Parsing log sources in configuration files	2017-03-12 23:12:21 +01:00
Thomas Patzke	12e825783b	Merge branch 'master' into devel-sigmac	2017-03-11 23:49:56 +01:00
Thomas Patzke	63e23af63c	Merge branch 'devel-sigmac-config' into devel-sigmac	2017-03-11 23:49:41 +01:00
Florian Roth	ad9f73a178	Merge branch 'devel-sigmac'	2017-03-07 10:49:03 +01:00
Florian Roth	b93379a6a9	Config example: sysmon / logstash index	2017-03-07 10:09:43 +01:00
Florian Roth	cd445f8ae9	Bugfix: non-recursive list not pathlib.Path elements but strings	2017-03-07 09:41:46 +01:00
Thomas Patzke	dae88fbcfa	Error and warning messages are printed to stderr	2017-03-06 23:01:33 +01:00
Thomas Patzke	d1030ec053	Fieldlist backend ... Lists all fields used in given rules.	2017-03-06 22:47:30 +01:00
Thomas Patzke	05df298d45	Field mappings	2017-03-06 22:07:04 +01:00
Thomas Patzke	6ddc15c972	Merge branch 'devel-sigmac' into devel-sigmac-config	2017-03-06 21:32:58 +01:00
Thomas Patzke	896b8fb56e	Finished path recursion	2017-03-06 21:26:56 +01:00
Florian Roth	da6c5c19ae	Update README.md	2017-03-06 09:37:44 +01:00
Florian Roth	362ff157ba	Update README.md	2017-03-06 09:37:31 +01:00
Florian Roth	df39dee702	Sigmac recursive feature	2017-03-06 09:36:24 +01:00
Thomas Patzke	8864647e04	Parsing of sigmac configuration files ... * field mappings * log sources	2017-03-05 23:44:52 +01:00
Thomas Patzke	f092333bb4	Sigmac configuration parsing	2017-03-05 00:56:45 +01:00
Thomas Patzke	4aaa22fd6d	Made not implemented sigmac features obvious ... * added notes to help message * error if not implemented option is used	2017-03-04 23:36:46 +01:00
Florian Roth	47bfe82cc4	Splunk specifics	2017-03-04 10:37:40 +01:00
Florian Roth	9971192bff	Create README.md	2017-03-03 13:45:55 +01:00
Florian Roth	b984d83685	Typo in help text	2017-03-03 12:47:20 +01:00
Thomas Patzke	8f3541f0a0	Added Splunk backend	2017-03-02 23:34:12 +01:00
Thomas Patzke	2dd1c7cd12	Deactivated not implemented backends	2017-03-02 22:55:45 +01:00
Thomas Patzke	9556e73cd1	Fix: automatic escaping of * and ? in es-qs backend removed	2017-03-02 12:07:07 +01:00
Thomas Patzke	10ee9c64fe	Moved node output into dedicated backend class methods	2017-03-01 21:47:51 +01:00