rsigma 0.18.0

CLI for parsing, validating, linting and evaluating Sigma detection rules
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93

{
  "summary": {
    "corpus_files": 2,
    "events_processed": 4,
    "rules_loaded": 3,
    "expectations_total": 2,
    "expectations_passed": 1,
    "expectations_failed": 1,
    "unexpected_rules": 1,
    "unexpected_fires": 1,
    "unexpected_policy": "fail",
    "duration_ms": 0
  },
  "expectations": [
    {
      "rule": "11111111-1111-1111-1111-111111111111",
      "rule_key": "11111111-1111-1111-1111-111111111111",
      "bound": ">= 1",
      "actual": 2,
      "pass": true
    },
    {
      "rule": "22222222-2222-2222-2222-222222222222",
      "rule_key": "22222222-2222-2222-2222-222222222222",
      "bound": "exactly 0",
      "actual": 1,
      "pass": false
    }
  ],
  "rules": [
    {
      "rule_id": "11111111-1111-1111-1111-111111111111",
      "rule_title": "Whoami Execution",
      "level": "low",
      "logsource": {
        "category": "process_creation",
        "product": "windows"
      },
      "fires": 2,
      "by_file": {
        "a.ndjson": 1,
        "b.ndjson": 1
      }
    },
    {
      "rule_id": "22222222-2222-2222-2222-222222222222",
      "rule_title": "Netstat Execution",
      "level": "informational",
      "logsource": {
        "category": "process_creation",
        "product": "windows"
      },
      "fires": 1,
      "by_file": {
        "a.ndjson": 1
      }
    },
    {
      "rule_id": "33333333-3333-3333-3333-333333333333",
      "rule_title": "Ping Execution",
      "level": "informational",
      "logsource": {
        "category": "process_creation",
        "product": "windows"
      },
      "fires": 1,
      "by_file": {
        "a.ndjson": 1
      }
    }
  ],
  "unexpected": [
    {
      "rule_key": "33333333-3333-3333-3333-333333333333",
      "rule_title": "Ping Execution",
      "level": "informational",
      "logsource": {
        "category": "process_creation",
        "product": "windows"
      },
      "fires": 1
    }
  ],
  "by_logsource": [
    {
      "logsource": "windows/process_creation",
      "unexpected_fires": 1,
      "rules": [
        "33333333-3333-3333-3333-333333333333"
      ]
    }
  ]
}