Sigma Versions Save

Main Sigma Rule Repository

0.16.0

4 years ago

Added

  • Proxy field names to ECS mapping (ecs-proxy) configuration
  • False positives metadata to LimaCharlie backend
  • Additional aggregation capabilitied for es-dsl backend.
  • Azure log analytics rule backend (ala-rule)
  • SQL backend
  • Splunk Zeek sourcetype mapping config
  • sigma2attack script
  • Carbon Black backend and configuration
  • ArcSight ESM backend
  • Elasticsearch detection rule backend

Changed

  • Kibana object id is now Sigma rule id if available. Else the old naming scheme is used.
  • sigma2misp: replacement of deprecated method usage.
  • Various configuration updates
  • Extended ArcSight mapping

Fixed

  • Fixed aggregation queries for Elastalert backend
  • Fixed aggregation queries for es-dsl backend
  • Backend and configuration lists are sorted.
  • Escaping in ala backend

0.15.0

4 years ago

Added

  • sigma-uuid tool for addition and check of Sigma rule identifiers
  • Default configurations
  • Restriction of compared rules in sigma-similarity
  • Regular expression support in es-dsl backend
  • LimaCharlie support for proxy rule category
  • Source distribution for PyPI

Changed

  • Type errors are now ignored with -I

Fixed

  • Removed wrong mapping of CommandLine field mapping in THOR config

0.12

4 years ago

Added

  • Usage of Channel field in ELK Windows configuration
  • Fields to mappings
  • xpack-watcher actions index and webhook
  • Config for Winlogbeat 7.x
  • Value modifiers
    • contains
    • alt
    • base64
    • base64offset
    • re
  • Regular expression support with value modifier re

Changed

  • Warning/error messages
  • Sumologic value cleaning
  • Explicit OR for Elasticsearch query strings
  • Listing of available configurations on missing configuration error

Fixed

  • Conditions in es-dsl backend
  • Sumologic handling of null values
  • Ignore timeframe detection keyword in all/any of conditions

0.12.1

4 years ago

Fixed

  • Missing build dependency

0.13

4 years ago

Added

  • Index mappings for Sumologic
  • Malicious cmdlets in wdatp
  • QRadar support for keyword searches
  • QRadar mapping improvements
  • QRadar field selection
  • QRadar type regex modifier support
  • Elasticsearch keyword field blacklisting with wildcards
  • Added dateField configuration parameter in xpack-watcher backend
  • Field mappings in configurations
  • Field name mapping for conditional fields
  • Value modifiers:
    • utf16
    • utf16le
    • wide
    • utf16be

Changed

  • Improved --backend-config help text

Fixed

  • Backend errors in ala
  • Slash escaping within es-dsl wildcard queries
  • QRadar backend config
  • QRadar field name and value escaping and handling
  • Elasticsearch wildcard detection pattern
  • Aggregation on keyword field in es-dsl backend

0.14

4 years ago

Added

  • sigma-similarity tool
  • LimaCharlie backend
  • Default configurations for some backends that are used if no configuration is passed
  • Regular expression support for es-dsl backend (propagates to backends derived from this like elastalert-dsl)
  • Value modifiers:
    • startswith
    • endswith

Changed

  • Removal of line breaks in elastalert output
  • Searches not bound to fields are restricted to keyword fields in es-qs backend
  • Graylog backend now based on es-qs backend

Fixed

  • Removed ProcessCommandLine mapping for Windows Security EventID 4688 in generic process creation log source configuration