Commits

Branch selector

 master

User selector

maximelb

Datepicker

All time

Commit History

Commits on Apr 2, 2020

• Remove generation of LC rules with timeframe.

  maximelb

  committed
  f92c5e9

Commits on Jan 24, 2020

• Fixed actual event tag

  

  maximelb

  authored and

  Florian Roth

  committed
  d1774f7

• Mapping OriginalFileName to event/INTERNAL_NAME now that it's available.

  

  maximelb

  authored and

  Florian Roth

  committed
  1bfb809

Commits on Dec 31, 2019

• Fixed actual event tag

  maximelb

  committed
  a3ad7cb

Commits on Dec 30, 2019

• Mapping OriginalFileName to event/INTERNAL_NAME now that it's available.

  maximelb

  committed
  9b32086

Commits on Dec 5, 2019

• Adding support for basic proxy rules using the HTTP_REQUEST events from the Chrome LC Agent.

  maximelb

  committed
  27bb07b

Commits on Nov 18, 2019

• Prettier formatting of YAML.

  maximelb

  committed
  61bcc46

Commits on Nov 15, 2019

• Adding the "falsepositives" field to the LC metadata.

  maximelb

  committed
  9eed57e

Commits on Nov 5, 2019

• Adding some comments

  maximelb

  committed
  1b9054c

• Adding a post-mapper mechanism to fix some common issues in Sigma rules to LC.

  maximelb

  committed
  b7018bc

• Fixing another edge case with string escape.

  maximelb

  committed
  c2e621c

• Remove debugging statement

  maximelb

  committed
  0c6b9e5

• Add ability to map fields and values based on callbacks.

  maximelb

  committed
  6f2f1d2

• Refactor to better support keyword fields.

  maximelb

  committed
  0b9a3f3

• Adding another exception case to get more "contains" shortcuts instead of REs.

  maximelb

  committed
  9aedb8f

• Fix the convertion from simple wildcard strings to a full regular expression so that it is always correct. The previous solution just mostly-worked.

  maximelb

  committed
  102ab30

• Fix matches operator field set to value instead of re.

  maximelb

  committed
  e52f29d

Commits on Oct 28, 2019

• Adding LimaCharlie to the README's supported targets.

  maximelb

  committed
  f01913c

• Fixing typo in response metadata.

  maximelb

  committed
  f6fb9c7

• Small refactors to make more readable and remove deprecated code paths to increase coverage.

  maximelb

  committed
  2873e1d

Commits on Oct 27, 2019

• Adding support for "unix", looking like a mistake by the creator.

  maximelb

  committed
  a7003c2

• Ading a bit more of early support for netflow and some linux exe.

  maximelb

  committed
  d019cef

• Added conceptial support for aliasing keyworkds to a specific field depending on the log source.

  maximelb

  committed
  a57a7b5

• Fixing handling of unsupported sources.

  maximelb

  committed
  60b20a7

• Emit error on full-text searches not being supported.

  maximelb

  committed
  0fe72d6

• Fix the top level pre-condition for Windows Event Logs on LC.

  maximelb

  committed
  f43300a

• Adding setup links and fixing test that would crash Not node, but not seen in prod rules.

  maximelb

  committed
  91e48d8

Commits on Oct 26, 2019

• Adding comments.

  maximelb

  committed
  8d866b0

• Making rule output a full D&R (with the Response component) and includes a lot of metadata from the rule in the report.

  maximelb

  committed
  bc5e9bd

• Extending support for more random rules with odd names.

  maximelb

  committed
  8cc3990

• Adding support for generating rules for Windows builtin category for use in the External Logs of LC.

  maximelb

  committed
  4d65b62

• Refactor mappings into a flat structure to account for missing parameters in some combinations.

  maximelb

  committed
  30cc7ee

• Adding service to indirection of mappings since it will be used for Windows Event Logs.

  maximelb

  committed
  7732971

• Remove unimplemented config entries and fix bug with valueNode.

  maximelb

  committed
  823d86c

• First draft of support for LimaCharlie D&R rules.

  maximelb

  committed
  bba43c7