Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Deal with empty string for ignore_case_brackets #302

Merged
merged 2 commits into from
Nov 10, 2024
Merged

Deal with empty string for ignore_case_brackets #302

merged 2 commits into from
Nov 10, 2024

Conversation

frack113
Copy link
Member

@frack113 frack113 commented Nov 8, 2024

An empty string must convert to a complex regex .

title: test
id: c6c14f6d-e430-4737-bca7-b0fe5496dc07
status: test
date: 2024-11-08
logsource:
    product: windows
    category: pipe_created
detection:
    selection_1:
        Image: null
    selection_2:
        Image: ''
    condition: 1 of selection_*
level: medium
name: CaseSensitive
priority: 20
transformations:
  - id: field_case
    type: regex
    method: ignore_case_brackets
    field_name_conditions:
      - type: include_fields
        fields: 
          - Image

Before

sigma convert -t lucene rule.yml -p casesensitive.yml
Parsing Sigma rules  [####################################]  100%
(NOT _exists_:Image) OR Image://
sigma convert -t splunk rule.yml -p casesensitive.yml
Parsing Sigma rules  [####################################]  100%
Error: Error while conversion: ORing regular expressions is not yet supported by Splunk backend in rule.yml

After

sigma convert -t lucene rule.yml -p casesensitive.yml
Parsing Sigma rules  [####################################]  100%
(NOT _exists_:Image) OR Image:""

sigma convert -t splunk rule.yml -p casesensitive.yml
Parsing Sigma rules  [####################################]  100%
Image!=* OR Image=""

@thomaspatzke thomaspatzke merged commit ebbe618 into SigmaHQ:main Nov 10, 2024
15 checks passed
@frack113 frack113 deleted the null-regex branch November 10, 2024 08:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@thomaspatzke thomaspatzke thomaspatzke approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@frack113 @thomaspatzke