search

markuskont / go-sigma-rule-engine

Golang library that implements a sigma log rule parser and match engine.
Apache License 2.0
88 stars 17 forks source link

Documentation - More info on detection/selection/condition fields and supported operators? #36

Open pritster5 opened 7 months ago

pritster5 commented 7 months ago

Is it possible to get a section in the readme that details what kinds of things are supported by the detection/selection/condition fields? I.e. how much of the SIGMA specification is supported?

I noticed that some rules use |contains or |endswith in their selection fields. Are there other processors that are supported? What isn't allowed?