Skip to content

Instantly share code, notes, and snippets.

@thomaspatzke
Last active September 3, 2023 21:27
Show Gist options
  • Save thomaspatzke/ea9e54a459b74e3ec9593c0329575eb8 to your computer and use it in GitHub Desktop.
Save thomaspatzke/ea9e54a459b74e3ec9593c0329575eb8 to your computer and use it in GitHub Desktop.
Processing pipeline using the query postprocessing and output finalization transformations to create a custom Splunk savedsearches.conf output with Sigma CLI
postprocessing:
- type: template
template: |+
[{{ rule.id }}]
search = {{ query }} | eval rule="{{ rule.id }}", title="{{ rule.title }}" | collect index=notable_events
description = {{ rule.description }}
finalizers:
- type: concat
prefix: |
[default]
cron_schedule = */15 * * * *
dispatch.earliest_time = -20m@m
dispatch.latest_time = -5m@m
postprocessing:
- type: template
template: |+
[{{ rule.id }}]
search = {{ query }} | eval rule="{{ rule.id }}", title="{{ rule.title }}" | collect index=notable_events
description = {{ rule.description }}
finalizers:
- type: template
template: |
[default]
cron_schedule = */15 * * * *
dispatch.earliest_time = -20m@m
dispatch.latest_time = -5m@m
{{ queries | join('\n') }}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment