search

Yamato-Security / hayabusa

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
GNU General Public License v3.0
2.18k stars 189 forks source link

Dynamically create a table of supported field modifiers #1406

Closed YamatoSecurity closed 1 week ago

YamatoSecurity commented 2 weeks ago

@fukusuket Could I ask you to do this one? I would like a markdown table of all of the field modifiers used in Sigma rules ranked by usage and an indicator of whether Hayabusa supports it or not.

So in a daily github action, we download the upstream sigma rules and check the different field modifiers and output the following table to /docs/SupportedSigmaFieldModifiers.md

Count Field Modifier Hayabusa Support
100 |contains Yes
50 |contains|all Yes
30 |all Yes
20 |re Yes
10 |newmodifier No

This will be useful to check if any new modifiers are being used that Hayabusa does not support and also when learning how to write Sigma rules it is good to know which modifiers are most common, etc...

fukusuket commented 2 weeks ago

Sounds good! Yes, I would love to implement it!💪

hitenkoku commented 2 weeks ago

FYI: https://pandas.pydata.org/docs/reference/api/pandas.DataFrame.to_markdown.html