Regex fails if piped to |contains

SigmaHQ / pySigma-backend-crowdstrike

SigmaHQ pySigma CrowdStrike processing pipeline

GNU Lesser General Public License v2.1

19 stars 12 forks source link

Regex fails if piped to |contains #10

Closed joshnck closed 1 month ago

joshnck commented 2 months ago

https://github.com/SigmaHQ/pySigma-backend-crowdstrike/blob/1d673eabf9aeffa0ca826e01b6ce79d0451e9f72/sigma/pipelines/crowdstrike/crowdstrike.py#L443

I think this can be fixed with (^[C-Z]:)|(\*[C-Z]:) but I have not validated it yet.

joshnck commented 2 months ago

I'm also okay with this being closed as a non-issue because c:\ should always be used with |startswith. Just something I noticed while doing some tuning.

moullos commented 1 month ago

Hi @joshnck

This ended up highlighting some possible improvements to the backend so I ended up fixing it.

Thank you!