pySigma-backend-loki

pySigma-backend-loki copied to clipboard

When a query contains multiple OR'd regular expressions, each testing the same field for similar strings (i.e., (fieldA=~"abc" OR fieldA=~"abd" OR fieldA=~"abe"), we could generate a shorter/easier to read (and possibly better performance?) query if we combined them into a single regex using brackets and vertical bars - especially if a common substring from each pattern could be extracted (i.e., fieldA=~"ab(c|d|e)" achieves the same outcome and is much easier to read).