search

Velocidex / velociraptor-sigma-rules

A Compiler from Sigma rules to VQL
10 stars 4 forks source link

Added an ignore list for bad rules. #31

Closed scudette closed 7 months ago

scudette commented 7 months ago

Previously broken rules (those who referenced invalid fields) where rejected with a warning. But there were so many rejected rules that it was difficult to see when new rules were accidentally rejected when syncing new rule sets.

This PR:

  1. Adds an ignore list to the rules so bad rules which are already known are not emitting errors any more.
  2. Uses a data dump from provider manifests to add trivial field mappings (where the field mapping is simply the EventData field). This helps with maintaining the field mapping for rules using this trivial field mapping.

This should make it easier to sync new rules.