sigma

type AggregationExpr interface {
	// contains filtered or unexported methods
}

type AggregationFunc interface {
	// contains filtered or unexported methods
}

type AllOfIdentifier struct {
	Ident SearchIdentifier
}

type AllOfPattern struct {
	Pattern string
}

type AllOfThem struct{}

type And []SearchExpr

type Average struct {
	Field     string
	GroupedBy string
}

type Comparison struct {
	Func      AggregationFunc
	Op        ComparisonOp
	Threshold float64
}

type ComparisonOp string

type Condition struct {
	Search      SearchExpr      `yaml:"search,omitempty" json:"Search,omitempty"`
	Aggregation AggregationExpr `yaml:"aggregation,omitempty" json:"Aggregation,omitempty"`
	// contains filtered or unexported fields
}

type Conditions []Condition

type Config struct {
	Title         string   // A short description of what this configuration does
	Order         int      // Defines the order of expansion when multiple config files are applicable
	Backends      []string // Lists the Sigma implementations that this config file is compatible with
	FieldMappings map[string]FieldMapping
	Logsources    map[string]LogsourceMapping
	// TODO: LogsourceMerging option
	DefaultIndex string                   // Defines a default index if no logsources match
	Placeholders map[string][]interface{} // Defines values for placeholders that might appear in Sigma rules
}

type Correlation struct {
	Type      string                 `json:"type,omitempty" yaml:"type,omitempty"`
	Rules     []string               `json:"rules,omitempty" yaml:"rules,omitempty"`
	GroupBy   []string               `json:"group-by,omitempty" yaml:"group-by,omitempty"`
	Timespan  string                 `json:"timespan,omitempty" yaml:"timespan,omitempty"`
	Condition map[string]interface{} `json:"condition,omitempty" yaml:"condition,omitempty"`
	Generate  bool                   `json:"generate,omitempty" yaml:"generate,omitempty"`
}

type Count struct {
	Field     string
	GroupedBy string
}

type Detection struct {
	Searches   map[string]Search `yaml:"searches,inline,omitempty" json:"Searches,inline,omitempty"`
	Conditions Conditions        `yaml:"condition,omitempty" json:"Condition,omitempty"`

	// This is not actually supported right now since there are no
	// aggregates so we just preserve it in its string form.
	// Timeframe  time.Duration     `yaml:",omitempty" json:",omitempty"`
	Timeframe string `yaml:",omitempty" json:",omitempty"`
}

type EventMatcher []FieldMatcher

type FieldMapping struct {
	TargetNames []string // The name(s) that appear in the events being matched

}

type FieldMatcher struct {
	Field     string        `yaml:"field,omitempty" json:"field,omitempty"`
	Modifiers []string      `yaml:"modifiers,omitempty" json:"modifiers,omitempty"`
	Values    []interface{} `yaml:"values,omitempty" json:"values,omitempty"`
	// contains filtered or unexported fields
}

type FileType string

type Logsource struct {
	Category   string `yaml:"category,omitempty" json:"Category,omitempty"`
	Product    string `yaml:"product,omitempty" json:"Product,omitempty"`
	Service    string `yaml:"service,omitempty" json:"Service,omitempty"`
	Definition string `yaml:"definition,omitempty" json:"Definition,omitempty"`

	// Any non-standard fields will end up in here
	AdditionalFields map[string]interface{} `yaml:",inline,omitempty" json:",inline,omitempty"`
}

type LogsourceIndexes []string

type LogsourceMapping struct {
	Logsource  `yaml:",inline,omitempty"` // Matches the logsource field in Sigma rules
	Index      LogsourceIndexes           // The index(es) that should be used
	Conditions Search                     // Conditions that are added to all rules targeting this logsource
	Rewrite    Logsource                  // Rewrites this logsource (i.e. so that it can be matched by another lower precedence config)
}

type Max struct {
	Field     string
	GroupedBy string
}

type Min struct {
	Field     string
	GroupedBy string
}

type Near struct {
	Condition SearchExpr
}

type Not struct {
	Expr SearchExpr
}

type OneOfIdentifier struct {
	Ident SearchIdentifier
}

type OneOfPattern struct {
	Pattern string
}

type OneOfThem struct{}

type Or []SearchExpr

type RelatedRule struct {
	ID   string
	Type string
}

type Rule struct {
	// Required fields
	Title       string       `yaml:"title,omitempty" json:"Title,omitempty"`
	Name        string       `yaml:"name,omitempty" json:"Name,omitempty"`
	Logsource   Logsource    `yaml:"logsource,omitempty" json:"Logsource,omitempty"`
	Detection   Detection    `yaml:"detection,omitempty" json:"Detection,omitempty"`
	Correlation *Correlation `yaml:"correlation,omitempty" json:"Correlation,omitempty"`

	ID          string        `yaml:"id,omitempty" json:"Id,omitempty"`
	Related     []RelatedRule `yaml:"related,omitempty" json:"related,omitempty"`
	Status      string        `yaml:"status,omitempty" json:"status,omitempty"`
	Description string        `yaml:"description,omitempty" json:"Description,omitempty"`
	Author      string        `yaml:"author,omitempty" json:"Author,omitempty"`
	Level       string        `yaml:"level,omitempty" json:"Level,omitempty"`

	// This field can be a list of strings or a single string. We
	// actually never care about this field so we just preserve it.
	// https://sigmahq.io/docs/basics/rules.html#metadata-references
	References interface{} `yaml:"references,omitempty" json:"References,omitempty"`
	Tags       []string    `yaml:"tags,omitempty" json:"Tags,omitempty"`

	// Any non-standard fields will end up in here
	AdditionalFields map[string]interface{} `yaml:",inline,omitempty" json:",inline,omitempty"`
}

type Search struct {
	Keywords      []string       `yaml:"keywords,omitempty" json:"keywords,omitempty"`
	EventMatchers []EventMatcher `yaml:"event_matchers,omitempty" json:"event_matchers,omitempty"`
	// contains filtered or unexported fields
}

type SearchExpr interface {
	// contains filtered or unexported methods
}

type SearchIdentifier struct {
	Name string `yaml:"name,omitempty" json:"Name,omitempty"`
}

type Sum struct {
	Field     string
	GroupedBy string
}