pySigma
pySigma copied to clipboard
Implementing NOT operation as `!=`
Discussed in https://github.com/SigmaHQ/pySigma/discussions/80
Originally posted by barvhaim December 6, 2022
Hello, I am migrating the STIX backend to pySigma, in order to translate rules includes not x, we don't have NOT (x) in the language but we have to modify the eq expression to != instead of =,
sel:
fieldA: valueA
fieldB: valueB
so in case of sel, I expect to fieldA = 'valueA' AND fieldB = 'valueB'
and in case of not sel, I expect to fieldA != 'valueA' OR fieldB != 'valueB'
(and the other way around with OR cases)
How do you recommend to do such translation?
we do control the nodes in the Sigmac version (https://github.com/SigmaHQ/sigma/blob/8fa8a7355141b525f5764ad5ff86caf6afc641c7/tools/sigma/backends/stix.py#L143), but wonder what would be the best way to implement that in the new pySigma