sigma

type AggregationExpr interface {
	// contains filtered or unexported methods
}

type AggregationFunc interface {
	// contains filtered or unexported methods
}

type AllOfIdentifier struct {
	Ident SearchIdentifier
}

type AllOfPattern struct {
	Pattern string
}

type AllOfThem struct{}

type And []SearchExpr

type Average struct {
	Field     string
	GroupedBy string
}

type Comparison struct {
	Func      AggregationFunc
	Op        ComparisonOp
	Threshold float64
}

type ComparisonOp string

type Condition struct {
	Search      SearchExpr      `yaml:",omitempty" json:",omitempty"`
	Aggregation AggregationExpr `yaml:",omitempty" json:",omitempty"`
	// contains filtered or unexported fields
}

type Conditions []Condition

type Config struct {
	Title         string   // A short description of what this configuration does
	Order         int      // Defines the order of expansion when multiple config files are applicable
	Backends      []string // Lists the Sigma implementations that this config file is compatible with
	FieldMappings map[string]FieldMapping
	Logsources    map[string]LogsourceMapping
	// TODO: LogsourceMerging option
	DefaultIndex string                   // Defines a default index if no logsources match
	Placeholders map[string][]interface{} // Defines values for placeholders that might appear in Sigma rules
}

type Count struct {
	Field     string
	GroupedBy string
}

type Detection struct {
	Searches   map[string]Search `yaml:",inline" json:",inline"`
	Conditions Conditions        `yaml:"condition" json:"condition"`
	Timeframe  time.Duration     `yaml:",omitempty" json:",omitempty"`
}

type EventMatcher []FieldMatcher

type FieldMapping struct {
	TargetNames []string // The name(s) that appear in the events being matched

}

type FieldMatcher struct {
	Field     string        `yaml:",omitempty" json:",omitempty"`
	Modifiers []string      `yaml:",omitempty" json:",omitempty"`
	Values    []interface{} `yaml:",omitempty" json:",omitempty"`
	// contains filtered or unexported fields
}

type FileType string

type Logsource struct {
	Category   string `yaml:",omitempty" json:",omitempty"`
	Product    string `yaml:",omitempty" json:",omitempty"`
	Service    string `yaml:",omitempty" json:",omitempty"`
	Definition string `yaml:",omitempty" json:",omitempty"`

	// Any non-standard fields will end up in here
	AdditionalFields map[string]interface{} `yaml:",inline,omitempty" json:",inline,omitempty"`
}

type LogsourceIndexes []string

type LogsourceMapping struct {
	Logsource  `yaml:",inline"` // Matches the logsource field in Sigma rules
	Index      LogsourceIndexes // The index(es) that should be used
	Conditions Search           // Conditions that are added to all rules targeting this logsource
	Rewrite    Logsource        // Rewrites this logsource (i.e. so that it can be matched by another lower precedence config)
}

type Max struct {
	Field     string
	GroupedBy string
}

type Min struct {
	Field     string
	GroupedBy string
}

type Near struct {
	Condition SearchExpr
}

type Not struct {
	Expr SearchExpr
}

type OneOfIdentifier struct {
	Ident SearchIdentifier
}

type OneOfPattern struct {
	Pattern string
}

type OneOfThem struct{}

type Or []SearchExpr

type RelatedRule struct {
	ID   string
	Type string
}

type Rule struct {
	// Required fields
	Title     string
	Logsource Logsource
	Detection Detection

	ID          string        `yaml:",omitempty" json:",omitempty"`
	Related     []RelatedRule `yaml:",omitempty" json:",omitempty"`
	Status      string        `yaml:",omitempty" json:",omitempty"`
	Description string        `yaml:",omitempty" json:",omitempty"`
	Author      string        `yaml:",omitempty" json:",omitempty"`
	Level       string        `yaml:",omitempty" json:",omitempty"`
	References  []string      `yaml:",omitempty" json:",omitempty"`
	Tags        []string      `yaml:",omitempty" json:",omitempty"`

	// Any non-standard fields will end up in here
	AdditionalFields map[string]interface{} `yaml:",inline,omitempty" json:",inline,omitempty"`
}

type Search struct {
	Keywords      []string       `yaml:",omitempty" json:",omitempty"`
	EventMatchers []EventMatcher `yaml:",omitempty" json:",omitempty"`
	// contains filtered or unexported fields
}

type SearchExpr interface {
	// contains filtered or unexported methods
}

type SearchIdentifier struct {
	Name string
}

type Sum struct {
	Field     string
	GroupedBy string
}