On the sigconverter.io you can modify both the sigma rule and the pipeline and get real-time updates of the results in the right panel. In the VSC extension you can get real time updates up the Sigma rule with your applied pipeline, but you cannot get real time updates of your pipeline.
On the sigconverter.io you can modify both the sigma rule and the pipeline and get real-time updates of the results in the right panel. In the VSC extension you can get real time updates up the Sigma rule with your applied pipeline, but you cannot get real time updates of your pipeline.
Here is my config:
Pipeline:
If I execute this and convert a Sigma rule, it works as expected:
Now, if I'd like to troubleshoot a configuration change in my pipeline with the following change:
Even after saving the yaml file for my pipeline - the updates do not apply until I open the command palate and run
Restart Extension Host
After restarting the extension host I can close the previous sigconverter window and open a new one where the changes are now applied: