Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add native Sigma support #1379

Merged
merged 14 commits into from
Feb 19, 2021
Merged

Add native Sigma support #1379

merged 14 commits into from
Feb 19, 2021

Commits on Feb 18, 2021

  1. Add preliminary Sigma rule parsing support

    @mavam
    mavam committed Feb 18, 2021
    Configuration menu
    Copy the full SHA
    f303883 View commit details
    Browse the repository at this point in the history

  2. Move normalization out of parse function

    @mavam
    mavam committed Feb 18, 2021
    Configuration menu
    Copy the full SHA
    f250bb5 View commit details
    Browse the repository at this point in the history

  3. Hook Sigma rule parsing into command system 

    We now try to parse a query expression as Sigma rule first. If it fails,
then we go to the regular VAST expression parser.

We currently fail silently on the Sigma parsing; only a debug log entry
is emitted.
    @mavam
    mavam committed Feb 18, 2021
    Configuration menu
    Copy the full SHA
    19f3f81 View commit details
    Browse the repository at this point in the history

  4. Complete full detection parsing logic 

    The "1/all of X" syntax now works. We also apply the "re" modifier and
translate an exact string into a pattern.
    @mavam
    mavam committed Feb 18, 2021
    Configuration menu
    Copy the full SHA
    4530d46 View commit details
    Browse the repository at this point in the history

  5. Add changelog entry

    @mavam
    mavam committed Feb 18, 2021
    Configuration menu
    Copy the full SHA
    37ed10f View commit details
    Browse the repository at this point in the history

  6. Bring back symbol table parser 

    This data structure was removed in
c6c4840 because it was not used
anymore. Now we need it again.
    @mavam
    mavam committed Feb 18, 2021
    Configuration menu
    Copy the full SHA
    ea33961 View commit details
    Browse the repository at this point in the history

  7. Add integration test

    @mavam
    mavam committed Feb 18, 2021
    Configuration menu
    Copy the full SHA
    9681fcd View commit details
    Browse the repository at this point in the history

  8. Refactor functions for easier testing

    @mavam
    mavam committed Feb 18, 2021
    Configuration menu
    Copy the full SHA
    58bdc51 View commit details
    Browse the repository at this point in the history

  9. Fixups buglets and add lots of unit tests

    @mavam
    mavam committed Feb 18, 2021
    Configuration menu
    Copy the full SHA
    5a5f320 View commit details
    Browse the repository at this point in the history

  10. Add comment about seemingly short test

    @mavam
    mavam committed Feb 18, 2021
    Configuration menu
    Copy the full SHA
    add41ef View commit details
    Browse the repository at this point in the history

  11. Add some preliminary escaping 

    This is not complete and by far not tested enough. It just serves as a
starting point. Since VAST currently cannot handle patterns, there's no
point in going exhaustive for now.
    @mavam
    mavam committed Feb 18, 2021
    Configuration menu
    Copy the full SHA
    9f4e7a3 View commit details
    Browse the repository at this point in the history

  12. Add comment regarding regex anchors

    @mavam
    mavam committed Feb 18, 2021
    Configuration menu
    Copy the full SHA
    2f98022 View commit details
    Browse the repository at this point in the history

  13. Bail out properly if we cannot handle a modifier

    @mavam
    mavam committed Feb 18, 2021
    Configuration menu
    Copy the full SHA
    44041fe View commit details
    Browse the repository at this point in the history

Commits on Feb 19, 2021

  1. Align parser name with name of data structure

    @mavam
    mavam committed Feb 19, 2021
    Configuration menu
    Copy the full SHA
    28a973e View commit details
    Browse the repository at this point in the history