search

SigmaHQ / pySigma-backend-splunk

pySigma Splunk backend
GNU Lesser General Public License v2.1
32 stars 19 forks source link

ORing modifier `CIDR` error #35

Open frack113 opened 3 months ago

frack113 commented 3 months ago

Hello When convert a rule with the cidr get an error

sigma convert -t splunk -p splunk_windows .\rules\windows\network_connection\net_connection_win_script_wan.yml
Parsing Sigma rules  [####################################]  100%
Error while conversion: ORing CIDR matching is not yet supported by Splunk backend in .\rules\windows\network_connection\net_connection_win_script_wan.yml

Try with only DestinationIp|cidr: '127.0.0.0/8' in the rule but get the same error.