Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement Correlation rules log source condition #274

Merged
merged 3 commits into from
Sep 9, 2024
Merged

Implement Correlation rules log source condition #274

merged 3 commits into from
Sep 9, 2024

Commits on Sep 9, 2024

  1. Implement Correlation rules logsource conditions 

    Rather than return false for all Correlation rules, change the behavior
of the log source condition pipeline to check each of the rules
referenced in the Correlation rule and test their logsources. The
logsource must fully match one or more of those rules in order to return
true.

This implementation operates recursively, checking rules that are nested
within correlated Correlation rules.
    @kelnage
    kelnage committed Sep 9, 2024
    Configuration menu
    Copy the full SHA
    784826e View commit details
    Browse the repository at this point in the history

  2. Fix linting errors

    @kelnage
    kelnage committed Sep 9, 2024
    Configuration menu
    Copy the full SHA
    d6b889a View commit details
    Browse the repository at this point in the history

  3. Rename test for consistency

    @kelnage
    kelnage committed Sep 9, 2024
    Configuration menu
    Copy the full SHA
    db19c1a View commit details
    Browse the repository at this point in the history