Skip to content

Latest commit

 

History

History
148 lines (105 loc) · 3.6 KB

CHANGELOG.md

File metadata and controls

148 lines (105 loc) · 3.6 KB
Raw

Release Notes

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning from version 0.14.0.

Unreleased

Fixed

  • Splunx XML rule name is now set to rule title

0.16.0 - 2020-02-25

Added

  • Proxy field names to ECS mapping (ecs-proxy) configuration
  • False positives metadata to LimaCharlie backend
  • Additional aggregation capabilitied for es-dsl backend.
  • Azure log analytics rule backend (ala-rule)
  • SQL backend
  • Splunk Zeek sourcetype mapping config
  • sigma2attack script
  • Carbon Black backend and configuration
  • ArcSight ESM backend
  • Elasticsearch detection rule backend

Changed

  • Kibana object id is now Sigma rule id if available. Else the old naming scheme is used.
  • sigma2misp: replacement of deprecated method usage.
  • Various configuration updates
  • Extended ArcSight mapping

Fixed

  • Fixed aggregation queries for Elastalert backend
  • Fixed aggregation queries for es-dsl backend
  • Backend and configuration lists are sorted.
  • Escaping in ala backend

0.15.0 - 2019-12-06

Added

  • sigma-uuid tool for addition and check of Sigma rule identifiers
  • Default configurations
  • Restriction of compared rules in sigma-similarity
  • Regular expression support in es-dsl backend
  • LimaCharlie support for proxy rule category
  • Source distribution for PyPI

Changed

  • Type errors are now ignored with -I

Fixed

  • Removed wrong mapping of CommandLine field mapping in THOR config

0.14 - 2019-11-10

Added

  • sigma-similarity tool
  • LimaCharlie backend
  • Default configurations for some backends that are used if no configuration is passed.
  • Regular expression support for es-dsl backend (propagates to backends derived from this like elastalert-dsl)
  • Value modifiers:
    • startswith
    • endswith

Changed

  • Removal of line breaks in elastalert output
  • Searches not bound to fields are restricted to keyword fields in es-qs backend
  • Graylog backend now based on es-qs backend

Fixed

  • Removed ProcessCommandLine mapping for Windows Security EventID 4688 in generic process creation log source configuration.

0.13 - 2019-10-21

Added

  • Index mappings for Sumologic
  • Malicious cmdlets in wdatp
  • QRadar support for keyword searches
  • QRadar mapping improvements
  • QRadar field selection
  • QRadar type regex modifier support
  • Elasticsearch keyword field blacklisting with wildcards
  • Added dateField configuration parameter in xpack-watcher backend
  • Field mappings in configurations
  • Field name mapping for conditional fields
  • Value modifiers:
    • utf16
    • utf16le
    • wide
    • utf16be

Changed

  • Improved --backend-config help text

Fixed

  • Backend errors in ala
  • Slash escaping within es-dsl wildcard queries
  • QRadar backend config
  • QRadar field name and value escaping and handling
  • Elasticsearch wildcard detection pattern
  • Aggregation on keyword field in es-dsl backend

0.12.1 - 2019-08-05

Fixed

  • Missing build dependency

0.12 - 2019-08-01

Added

  • Usage of "Channel" field in ELK Windows configuration
  • Fields to mappings
  • xpack-watcher actions index and webhook
  • Config for Winlogbeat 7.x
  • Value modifiers
  • Regular expression support

Changed

  • Warning/error messages
  • Sumologic value cleaning
  • Explicit OR for Elasticsearch query strings
  • Listing of available configurations on missing configuration error

Fixed

  • Conditions in es-dsl backend
  • Sumologic handling of null values
  • Ignore timeframe detection keyword in all/any of conditions