markuskont / go-sigma-rule-engine

Golang library that implements a sigma log rule parser and match engine.
Apache License 2.0
92 stars 17 forks source link

Added white space collapse functionality #10

Closed newodahs closed 2 years ago

newodahs commented 2 years ago

Per commit notes: Added collapse white space functionality and made it the default behavior. This functionality will collapse white space in non-regex rules and data for non-regex matching. This should allow us to avoid potential poisoning from someone padding white space into certain commands to avoid rule detection.

Regex (and data matching against it) is exempt from the above due to the complexity of regex to begin with.

Behavior may be disabled by setting NoCollapseWS on the Config struct to true.