search

theflakes / sigma_to_wazuh

Convert Sigma rules to Wazuh rules
MIT License
57 stars 14 forks source link

Fix rules without value modifiers #22

Closed PiRomant closed 7 months ago

PiRomant commented 7 months ago

Close https://github.com/theflakes/sigma_to_wazuh/issues/21 Result diff - https://www.diffchecker.com/ULkKIpud/

theflakes commented 7 months ago

Don't have a lot of time to test this but it looks like a good solution I missed, thanks. Will merge it shortly.

theflakes commented 7 months ago

Only concern is if it will cause issues with any non-mapped fields, e.g. fields where the "full_log" field name is used to search the entire log.

PiRomant commented 7 months ago

@theflakes, your code is ready for this. It will remove the ^ and $ leaving only the parentheses. https://github.com/theflakes/sigma_to_wazuh/blob/cc09245cf326590ad455ae357e3347c8b7c797b3/sigma_to_wazuh.py#L181-L190 As you can see in Result diff every name="full_log" is fine.