pySigma 0.8.4

• Improved rule error collection for checking of rules.

pySigma 0.8.3

• Generalized SigmaValidator.validate_rule_collection method into validate_rules
• Added intrusion sets and malwares to ATT&CK validation

pySigma 0.8.2

What's Changed

• Rule validation framework and validators.
• Fix crash at calling startswith/endswith on empty strings by @alexott in #62

New Contributors

• @alexott made their first contribution in #62

Full Changelog: v0.8.1...v0.8.2

pySigma 0.8.1

Fixes:

• Field name condition tracking only adds processing item to tracking set if transformation does change fields.
• Field name condition matching distinguished for field names and detection items.
• FieldNameProcessingItemAppliedCondition now checks on field name and detection item processing set depends if a field name or detection item is checked.

pySigma 0.8.0

• Added field name processing conditions that are also applied to the Sigma rule field name list.
• Breaking change: IncludeFieldCondition and ExcludeFieldCondition are now field name conditions and have to be moved from the detection_item_conditions to the new field_name_conditions list of a processing item.
• Tracking of applied processing items on field names. Added FieldNameProcessingItemAppliedCondition field name condition that checks if a processing item was applied to a field name.

pySigma 0.7.3

• Various bugfixes
• Fail on deprecated pipe condition syntax

pySigma 0.7.2

• Added field name mapping tracking to ProcessingPipeline.field_mappings
• Added mapping of fields list in Sigma rules

pySigma 0.7.1

Additional CIDR expression template variables network, netmask and prefixlen.

pySigma 0.7.0

Change details

• Centralized string quoting and decision about it into methods.
• Conditional quoting based on pattern.
• Improved CIDR matching
  • Consolidated logic into less methods.
  • The class attribute cidr_expression defines an expression for native CIDR matching. If this is not present, the CIDR value is expanded into string wildcard matches that are ORed. The existing expression conversion logic is used in this case.

Breaking changes

• quotes have to be removed from template strings.
• only cidr_expression is supporte as class attribute. For the other values that had to be defined previously, defined in-list expressions are used.

pySigma 0.6.8

Added parenthesize option to TextQueryBackend.