Skip to content

Instantly share code, notes, and snippets.

@thomaspatzke
Last active September 1, 2023 22:11
Show Gist options
  • Save thomaspatzke/815a492eef8082484a3717e1ab28b395 to your computer and use it in GitHub Desktop.
Save thomaspatzke/815a492eef8082484a3717e1ab28b395 to your computer and use it in GitHub Desktop.
Full example processing pipeline from Medium blog post about processing pipelines: https://medium.com/sigma-hq/connecting-sigma-rule-sets-to-your-environment-with-processing-pipelines-4ee1bd577070
name: Fixing the field naming mess
priority: 30
transformations:
- id: image_fail_path
type: detection_item_failure
message: Image must only contain file name without any further path components.
field_name_conditions:
- type: include_fields
fields:
- Image
detection_item_conditions:
- type: match_string
cond: any
pattern: "^\\*\\\\?[^\\\\]+$"
negate: true
- id: image_file_only
type: replace_string
regex: "^\\*\\\\([^\\\\]+)$"
replacement: "\\1"
field_name_conditions:
- type: include_fields
fields:
- Image
- id: field_mapping
type: field_name_mapping
mapping:
EventID:
- event_id
- evtid
- id: windows_field_prefix
type: field_name_prefix
prefix: "win."
field_name_cond_not: true
field_name_conditions:
- type: processing_item_applied
processing_item_id: field_mapping
- id: index_condition
type: add_condition
conditions:
index: windows
rule_conditions:
- type: logsource
product: windows
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment