Tags: defenxor/dsiem
Tags
fix: fix dsiem directive rule custom data matching (#399) * cleanup for code clarity * split csv string matching and net address matching into different functions * update rule test * add custom data matching test * improv: add csv checking for custom data matching * fix: fix inverse behaviour on text matching
fix: dpluger can not check keyword on es6 (#392) * fix: remove _doc field type * ignore first mapping type * add option to specify goos and goarch * log cleanup * fix: add missing keyword check on source SID field * improve log message for invalid plugin sid value
feat: add support for variable strings (#386) * add tsv utilities * move logstash utilities to its own file * add test for tsv utilities * add template for variable strings * add test for variable strings template * rename field for clarity * update template field names * remove inline field set for clarity * add template documentation * rename field for clarity * add omitempty for custom-data set * change parameter-based configuration to struct-based for clarity * add option for including tsv-file * add template-group-by-custom-data to plugin template * add sid-list to plugin template * ignore coverage on internal dpluger package * add missing identifier block * fix: enable category field checking * tidy up es7 collect method * fix: fix empty parsed PluginSID simplify tsvref upsert plugin add test for tsvref upsert plugin * remove old tsvref upsert method * remove extra newline * doc: add in-code documentaiton * fix in-code documentation * change variable names for readability * fix: add variable strings support for non-collect run * add parsable implementation * fix: add variable strings support for collect-type run * add sid-list to viper binding * fix: fix incorrect template reference * add custom-data into plugin-sid set * add test for es7-client * change dpluger create plugin flow to match variable strings update * fix incorrect template indentation
build(deps): bump ajv from 6.10.2 to 6.12.6 in /web/ui (#383) Bumps [ajv](https://github.com/ajv-validator/ajv) from 6.10.2 to 6.12.6. - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v6.10.2...v6.12.6) --- updated-dependencies: - dependency-name: ajv dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Riki Syahputra <[email protected]>
PreviousNext