search

markuskont / go-sigma-rule-engine

Golang library that implements a sigma log rule parser and match engine.
Apache License 2.0
92 stars 17 forks source link

Made glob matching case-insensitive by default (reuse of 'lower' boolean var on creation) #37

Open newodahs opened 4 months ago

newodahs commented 4 months ago

Re: https://github.com/markuskont/go-sigma-rule-engine/issues/27

Modified gobwas/glob handler to do insensitive comparisons by default (ToLower everything); reusing the lower flag as we do everywhere else.

@markuskont I noted we have some calls to newStringKeyword that explicitly set the lower flag to false, which may not be desirable; I did not update those yet, but I suspect it's an issue? (see lines 96 and 109 in ident.go).