Thomas Patzke
fc276612b6
Added encoding modifiers
2019-10-16 23:52:06 +02:00
Thomas Patzke
849a5a520d
Conditional field mapping resolve_fieldname now functional
...
Before this method just had some placeholder function that wasn't really
implementing the intended functionality of the conditional field
mapping. Now aggregations get also conditional field mapping
functionality.
2019-10-09 23:57:41 +02:00
Thomas Patzke
805c739611
Merge branch 'devel-modifiers'
2019-07-31 23:44:10 +02:00
Thomas Patzke
8a3117d73e
Nested list handling for chained value modifiers
2019-07-16 23:03:19 +02:00
Thomas Patzke
6881967889
Further modifiers
...
* base64
* base64offset
2019-07-16 00:00:35 +02:00
Thomas Patzke
1bb29dca26
Implemented type modifiers and regular expressions
2019-07-15 22:52:10 +02:00
Thomas Patzke
134bfebe57
Ignore "timeframe" detection keyword in "all/any of" conditions
...
Fixes #395
2019-07-13 00:35:35 +02:00
Thomas Patzke
337681cfce
Value modifiers
...
* First transformation modfiers: contains, all
* Sigma converter modifier list
2019-06-30 23:41:28 +02:00
Thomas Patzke
eb022f3908
Conditional field mapping for null values
...
Fixes #326
2019-04-25 23:24:05 +02:00
Thomas Patzke
a9cf14438c
Merge branch 'master' into project-1
2019-01-14 22:36:15 +01:00
Thomas Patzke
aa1a953a65
Moved node dumping code to generic location
2018-11-21 23:22:38 +01:00
Thomas Patzke
26d888aec3
Removed "not null" handling code
...
Feature was removed some time ago.
2018-11-21 22:56:48 +01:00
Thomas Patzke
5053cc4e95
Fixed optimizing of not conditions with subexpressions
...
Optimization pass traversal is cut at ConditionNOT nodes.
2018-11-07 13:54:45 +01:00
Thomas Patzke
a88b1e81ec
Optimizer debugging code cleanup
...
* Removed commented debugging code
* Output to stdin
* Coverage exception for _dumpNode
2018-11-07 13:49:08 +01:00
Thomas Patzke
42ed8acec9
Improved test coverage
...
* Adding tests
* Removal of coverage measurement for debugging code
2018-11-04 23:28:40 +01:00
Thomas Patzke
e28bc35cad
Apply field mappings in generation of log source condition
2018-10-06 23:38:35 +02:00
Daniel Roethlisberger
fc45df144c
Improve the comments on the optimizer
2018-10-03 13:44:03 +02:00
Daniel Roethlisberger
87aa1b5521
Move optimizer to sigma.parser.condition to enable it for all backends
2018-10-03 00:24:31 +02:00
Thomas Patzke
d81946df39
Stacked configurations
...
- Added log source rewriting
- Removed log source merging condition type setting
- Simplified SigmaLogsourceConfiguration constructor
- Condition is generated in SigmaParser instead of SigmaLogsourceConfiguration
Missing:
- Merging of raw config dict for backends that rely on this (es-dsl)
2018-09-12 23:40:22 +02:00
Thomas Patzke
af9f636199
Removal of backend output classes
...
Breaking change: Instead of feeding the output class with the results,
they are now returned as strings (*Backend.generate()) or list
(SigmaCollectionParser.generate()). Users of the library must now take
care of the output to the terminal, files or wherever Sigma rules should
be pushed to.
2018-08-02 22:41:32 +02:00
Thomas Patzke
df74460629
Fixed imports after config split
2018-07-27 23:54:18 +02:00
Thomas Patzke
1c4c67053c
Fixes for parser split
...
* Fixed imports
* Rename
2018-07-27 00:02:07 +02:00
Thomas Patzke
88a4a5d36a
Merge parser split branches
2018-07-26 23:42:09 +02:00
Thomas Patzke
595327ace4
Split parser - code removal from condition
2018-07-26 23:40:22 +02:00
Thomas Patzke
c8043368bd
Split parser - code removal from rule
2018-07-26 22:43:49 +02:00
Thomas Patzke
294ca20350
Split parser - code removal from collection
2018-07-26 22:28:33 +02:00
Thomas Patzke
3a0de01bad
Split parser - code removal from base
2018-07-26 22:22:21 +02:00
Thomas Patzke
b9425d13df
Split parser - code removal from exceptions
2018-07-26 22:18:21 +02:00
Thomas Patzke
e550bf5c3b
Split parser - Copy base
2018-07-26 22:15:04 +02:00
Thomas Patzke
a2329de03c
Split parser - Copy rule
2018-07-26 22:07:38 +02:00
Thomas Patzke
1abb13c5d9
Split parser - Copy condition
2018-07-24 00:13:37 +02:00
Thomas Patzke
a8501cb446
Split parser - Copy exceptions
2018-07-24 00:08:23 +02:00
Thomas Patzke
983ee6eeb9
Splitting parser - copying collections
2018-07-24 00:06:02 +02:00
