Fixing re double escape issue

SigmaHQ / pySigma-backend-elasticsearch

pySigma Elasticsearch backend

GNU Lesser General Public License v3.0

42 stars 26 forks source link

Fixing re double escape issue #12

Closed andurin closed 1 year ago

andurin commented 1 year ago

Relates: #9

@thomaspatzke Do you know any breaking things with this? I'm currently not that happy with just replacing the double escapes. But as far as I can see the single \ from the rule is already escaped by python reading strings. May be the string replace would make sense also for other backend during building SigmaCollections?

thomaspatzke commented 1 year ago

Added this in pySigma as option for the RE escaping. I think is is a more elegant solution than removing just added backslashes.