Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Sigma rules support #101

Open
20 of 26 tasks
araujof opened this issue Feb 10, 2023 · 1 comment
Open
20 of 26 tasks

Add Sigma rules support #101

araujof opened this issue Feb 10, 2023 · 1 comment
Assignees
@araujof @terylt
Labels
enhancement New feature or request sf-processor Issue in sf-processor repo

Comments

@araujof
Copy link
Member

araujof commented Feb 10, 2023 •
edited
Loading

Indicate project
Processor

Overview
We want to enable Sigma rules evaluation in the SysFlow Processor, using our policy engine architecture as the base framework.

Tasks

  • Refactoring to enable multi-language support
    • Upgrade to Go 1.19
    • Separation between policy front and backend compilation
    • Generics (parametric record, to enable different backends for different input sources)
  • Sigma frontend
    • Condition expression language (1|all of selection, logical operators, wildcards)
    • Search evaluation (event matching)
      • Field modifiers
      • Field transformers
        • WinDash
        • Base64
        • Base64Offset
        • UTF16 (BE, LE, BOM)
        • Wide (UTF16)
        • CIDR
    • Keywords
    • Field mapping support
  • Sigma backend support
    • Operations and operators abstraction
    • Refactored operations to support multi-language operations
    • Added RegExp operation
  • Field mapping for SysFlow
  • Unit tests
  • Sigma rule curation
  • Performance tests
  • Documentation

Additional context
Working branch: https://github.com/sysflow-telemetry/sf-processor/tree/go1.19-sigma
@araujof araujof added enhancement New feature or request sf-processor Issue in sf-processor repo labels Feb 10, 2023
@araujof araujof added this to 0.7.0 Jan 11, 2024
@araujof
Copy link
Member Author

araujof commented Jan 11, 2024

Release experimentally in 0.6.0

@araujof araujof added this to 0.6.0 Jan 11, 2024
@araujof araujof moved this to Done in 0.6.0 Jan 11, 2024
@araujof araujof moved this to In Progress in 0.7.0 Jan 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@araujof araujof

@terylt terylt

Labels
enhancement New feature or request sf-processor Issue in sf-processor repo
Projects
0.7.0
Status: In Progress
0.6.0
Status: Done
Milestone
No milestone
Development

No branches or pull requests
2 participants
@araujof @terylt