sigma

type AggregationExpr interface {
	// contains filtered or unexported methods
}

type AggregationFunc interface {
	// contains filtered or unexported methods
}

type AllOfIdentifier struct {
	Ident SearchIdentifier
}

type AllOfPattern struct {
	Pattern string
}

type AllOfThem struct{}

type And []SearchExpr

type Average struct {
	Field     string
	GroupedBy []string
}

type Comparison struct {
	Func      AggregationFunc
	Op        ComparisonOp
	Threshold float64
}

type ComparisonOp string

type Condition struct {
	Search      SearchExpr      `yaml:",omitempty" json:",omitempty"`
	Aggregation AggregationExpr `yaml:",omitempty" json:",omitempty"`
	// contains filtered or unexported fields
}

type Conditions []Condition

type Config struct {
	Title         string   // A short description of what this configuration does
	Order         int      // Defines the order of expansion when multiple config files are applicable
	Backends      []string // Lists the Sigma implementations that this config file is compatible with
	FieldMappings map[string]FieldMapping
	Logsources    map[string]LogsourceMapping
	// LogsourceMerging controls how the conditions contributed by matching logsource
	// mappings are combined: "and" (default) requires all to match, "or" requires any.
	LogsourceMerging LogsourceMerging         `yaml:"logsourcemerging,omitempty"`
	DefaultIndex     string                   // Defines a default index if no logsources match
	Placeholders     map[string][]interface{} // Defines values for placeholders that might appear in Sigma rules
}

type Correlation struct {
	// Type is one of event_count, value_count, temporal, temporal_ordered.
	Type string `yaml:",omitempty" json:",omitempty"`

	// Rules references the correlated rules by their `name` or `id`.
	Rules []string `yaml:",omitempty" json:",omitempty"`

	// GroupBy lists the fields whose values partition events into independent
	// correlation buckets (parsed from the `group-by` key).
	GroupBy []string `yaml:"group-by,omitempty" json:"group-by,omitempty"`

	// Timespan is the sliding window over which the correlation is evaluated.
	Timespan Timespan `yaml:",omitempty" json:",omitempty"`

	// Aliases optionally maps a group-by alias to the concrete field name used by
	// each referenced rule: aliases[alias][ruleNameOrID] = fieldName.
	Aliases map[string]map[string]string `yaml:",omitempty" json:",omitempty"`

	// Condition holds the threshold for event_count / value_count correlations.
	Condition *CorrelationCondition `yaml:",omitempty" json:",omitempty"`
}

type CorrelationCondition struct {
	// Op is one of gt, gte, lt, lte, eq, neq.
	Op string
	// Count is the threshold the (event or value) count is compared against.
	Count int
	// Field is the field whose distinct values are counted (value_count only).
	Field string
}

type Count struct {
	Field     string
	GroupedBy []string
}

type Detection struct {
	Searches   map[string]Search `yaml:",inline" json:",inline"`
	Conditions Conditions        `yaml:"condition" json:"condition"`
	Timeframe  time.Duration     `yaml:",omitempty" json:",omitempty"`
}

type EventMatcher []FieldMatcher

type FieldMapping struct {
	TargetNames []string // The name(s) that appear in the events being matched

}

type FieldMatcher struct {
	Field     string        `yaml:",omitempty" json:",omitempty"`
	Modifiers []string      `yaml:",omitempty" json:",omitempty"`
	Values    []interface{} `yaml:",omitempty" json:",omitempty"`
	// contains filtered or unexported fields
}

type FileType string

type Logsource struct {
	Category   string `yaml:",omitempty" json:",omitempty"`
	Product    string `yaml:",omitempty" json:",omitempty"`
	Service    string `yaml:",omitempty" json:",omitempty"`
	Definition string `yaml:",omitempty" json:",omitempty"`

	// Any non-standard fields will end up in here
	AdditionalFields map[string]interface{} `yaml:",inline,omitempty" json:",inline,omitempty"`
}

type LogsourceIndexes []string

type LogsourceMapping struct {
	Logsource  `yaml:",inline"` // Matches the logsource field in Sigma rules
	Index      LogsourceIndexes // The index(es) that should be used
	Conditions Search           // Conditions that are added to all rules targeting this logsource
	Rewrite    Logsource        // Rewrites this logsource (i.e. so that it can be matched by another lower precedence config)
}

type LogsourceMerging string

type Max struct {
	Field     string
	GroupedBy []string
}

type Min struct {
	Field     string
	GroupedBy []string
}

type Near struct {
	Condition SearchExpr
}

type Not struct {
	Expr SearchExpr
}

type OneOfIdentifier struct {
	Ident SearchIdentifier
}

type OneOfPattern struct {
	Pattern string
}

type OneOfThem struct{}

type Or []SearchExpr

type RelatedRule struct {
	ID   string
	Type string
}

type Rule struct {
	// Required fields
	Title     string
	Logsource Logsource
	Detection Detection

	ID          string        `yaml:",omitempty" json:",omitempty"`
	Name        string        `yaml:",omitempty" json:",omitempty"`
	Related     []RelatedRule `yaml:",omitempty" json:",omitempty"`
	Status      string        `yaml:",omitempty" json:",omitempty"`
	Description string        `yaml:",omitempty" json:",omitempty"`
	Author      string        `yaml:",omitempty" json:",omitempty"`
	Level       string        `yaml:",omitempty" json:",omitempty"`
	References  []string      `yaml:",omitempty" json:",omitempty"`
	Tags        []string      `yaml:",omitempty" json:",omitempty"`

	// Correlation is set for Sigma correlation rules (documents with a top-level
	// `correlation:` key) and is nil for normal detection rules.
	Correlation *Correlation `yaml:",omitempty" json:",omitempty"`

	// Any non-standard fields will end up in here
	AdditionalFields map[string]interface{} `yaml:",inline,omitempty" json:",inline,omitempty"`
}

type Search struct {
	Keywords      []string       `yaml:",omitempty" json:",omitempty"`
	EventMatchers []EventMatcher `yaml:",omitempty" json:",omitempty"`
	// contains filtered or unexported fields
}

type SearchExpr interface {
	// contains filtered or unexported methods
}

type SearchIdentifier struct {
	Name string
}

type Sum struct {
	Field     string
	GroupedBy []string
}

type Timespan time.Duration