search

google / timesketch

Collaborative forensic timeline analysis
Apache License 2.0
2.62k stars 589 forks source link

Add a test case for conditions with multiple words in a Sigma rule #2835

Closed jaegeral closed 1 year ago

jaegeral commented 1 year ago

adding a new unit test case for Sigma parser to cover the issue mentioned in https://github.com/google/timesketch/issues/2550 where multiple words in a condition could lead to edge cases.

closes #2550