Thomas Patzke
805c739611
Merge branch 'devel-modifiers'
2019-07-31 23:44:10 +02:00
Thomas Patzke
8a3117d73e
Nested list handling for chained value modifiers
2019-07-16 23:03:19 +02:00
Thomas Patzke
6881967889
Further modifiers
...
* base64
* base64offset
2019-07-16 00:00:35 +02:00
Thomas Patzke
1bb29dca26
Implemented type modifiers and regular expressions
2019-07-15 22:52:10 +02:00
Thomas Patzke
134bfebe57
Ignore "timeframe" detection keyword in "all/any of" conditions
...
Fixes #395
2019-07-13 00:35:35 +02:00
Thomas Patzke
337681cfce
Value modifiers
...
* First transformation modfiers: contains, all
* Sigma converter modifier list
2019-06-30 23:41:28 +02:00
Thomas Patzke
eb022f3908
Conditional field mapping for null values
...
Fixes #326
2019-04-25 23:24:05 +02:00
Thomas Patzke
a9cf14438c
Merge branch 'master' into project-1
2019-01-14 22:36:15 +01:00
Thomas Patzke
aa1a953a65
Moved node dumping code to generic location
2018-11-21 23:22:38 +01:00
Thomas Patzke
26d888aec3
Removed "not null" handling code
...
Feature was removed some time ago.
2018-11-21 22:56:48 +01:00
Thomas Patzke
5053cc4e95
Fixed optimizing of not conditions with subexpressions
...
Optimization pass traversal is cut at ConditionNOT nodes.
2018-11-07 13:54:45 +01:00
Thomas Patzke
a88b1e81ec
Optimizer debugging code cleanup
...
* Removed commented debugging code
* Output to stdin
* Coverage exception for _dumpNode
2018-11-07 13:49:08 +01:00
Thomas Patzke
42ed8acec9
Improved test coverage
...
* Adding tests
* Removal of coverage measurement for debugging code
2018-11-04 23:28:40 +01:00
Thomas Patzke
e28bc35cad
Apply field mappings in generation of log source condition
2018-10-06 23:38:35 +02:00
Daniel Roethlisberger
fc45df144c
Improve the comments on the optimizer
2018-10-03 13:44:03 +02:00
Daniel Roethlisberger
87aa1b5521
Move optimizer to sigma.parser.condition to enable it for all backends
2018-10-03 00:24:31 +02:00
Thomas Patzke
d81946df39
Stacked configurations
...
- Added log source rewriting
- Removed log source merging condition type setting
- Simplified SigmaLogsourceConfiguration constructor
- Condition is generated in SigmaParser instead of SigmaLogsourceConfiguration
Missing:
- Merging of raw config dict for backends that rely on this (es-dsl)
2018-09-12 23:40:22 +02:00
Thomas Patzke
af9f636199
Removal of backend output classes
...
Breaking change: Instead of feeding the output class with the results,
they are now returned as strings (*Backend.generate()) or list
(SigmaCollectionParser.generate()). Users of the library must now take
care of the output to the terminal, files or wherever Sigma rules should
be pushed to.
2018-08-02 22:41:32 +02:00
Thomas Patzke
df74460629
Fixed imports after config split
2018-07-27 23:54:18 +02:00
Thomas Patzke
1c4c67053c
Fixes for parser split
...
* Fixed imports
* Rename
2018-07-27 00:02:07 +02:00
Thomas Patzke
88a4a5d36a
Merge parser split branches
2018-07-26 23:42:09 +02:00
Thomas Patzke
595327ace4
Split parser - code removal from condition
2018-07-26 23:40:22 +02:00
Thomas Patzke
c8043368bd
Split parser - code removal from rule
2018-07-26 22:43:49 +02:00
Thomas Patzke
294ca20350
Split parser - code removal from collection
2018-07-26 22:28:33 +02:00
Thomas Patzke
3a0de01bad
Split parser - code removal from base
2018-07-26 22:22:21 +02:00
Thomas Patzke
b9425d13df
Split parser - code removal from exceptions
2018-07-26 22:18:21 +02:00
Thomas Patzke
e550bf5c3b
Split parser - Copy base
2018-07-26 22:15:04 +02:00
Thomas Patzke
a2329de03c
Split parser - Copy rule
2018-07-26 22:07:38 +02:00
Thomas Patzke
1abb13c5d9
Split parser - Copy condition
2018-07-24 00:13:37 +02:00
Thomas Patzke
a8501cb446
Split parser - Copy exceptions
2018-07-24 00:08:23 +02:00
Thomas Patzke
983ee6eeb9
Splitting parser - copying collections
2018-07-24 00:06:02 +02:00
