pySigma
pySigma copied to clipboard
Unbond search invalid with field_name_mapping
When use the field_name_mapping to map to a field name the query lose the contrains
title: Example Rule
description: This is an example rule to demonstrate the structure of a YAML rule file.
logsource:
product: linux
detection:
keywords:
- a
- b
- c
condition: keywords
name: Default field name
transformations:
- id: field_mapping
type: field_name_mapping
mapping:
null:
- my_field_name
Test with pysigma 0.11.23 and sigma-cli-1.0.6
| target | Without pipeline | With pipeline | |
|---|---|---|---|
| pySigma-backend-elasticsearch-1.1.6 | lucene | *a* OR *b* OR *c* |
my_field_name:(a OR b OR c) |
| PySigma-backend-splunk-1.1.3 | splunk | "a" OR "b" OR "c" |
my_field_name IN ("a", "b", "c") |
| Pysigma-backend-sqlite-0.2.0 | sqlite | Not supported | Not Supported |
| PySigma-backend-golangexpr-0.1.2 | golang_expr | ""a"" or ""b"" or ""c"" |
lower(my_field_name) == lower("a") or lower(my_field_name) == lower("b") or lower(my_field_name) == lower("c") |