Enabling Index selection for SIEM NDJSON Policies

SigmaHQ / pySigma-backend-elasticsearch

pySigma Elasticsearch backend

GNU Lesser General Public License v3.0

42 stars 26 forks source link

Enabling Index selection for SIEM NDJSON Policies #69

Closed WildDogOne closed 2 months ago

WildDogOne commented 3 months ago

I have noticed that the EQL Backend does not support the usage of state variables to change the index used in the SIEM Rule. However ESQL does allow for that.

I have built a dirty hack around this, since I don't 100% understand the logic of how it should be used. It works, but I am sure there is a better way