sigma-workshop-operationalization/pipeline-3.yml at main · thomaspatzke/sigma-workshop-operationalization · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
name: Target data model
priority: 30
transformations:
- id: field_mapping
  type: field_name_mapping
  mapping:
    Image: ImageFileName
- id: drop_fields
  type: drop_detection_item
  field_name_conditions:
    - type: include_fields
      fields:
        - OriginalFileName
- id: fail_on_dir_in_path
  type: detection_item_failure
  message: "ImageFileName should not contain a directory path"
  field_name_conditions:
    - type: include_fields
      fields:
        - ImageFileName
  detection_item_conditions:
    - type: match_string
      cond: any
      pattern: "^\\*\\\\?[^\\\\]+$"
      negate: true
- id: path_to_file_name
  type: replace_string
  regex: "^\\*\\\\([^\\\\]+)$"
  replacement: "\\1"
  field_name_conditions:
    - type: include_fields
      fields:
        - ImageFileName
- id: windows_conditions
  type: add_condition
  conditions:
    index: windows
    sourcetype: Custom:$category
  template: yes
  rule_conditions:
    - type: logsource
      product: windows