New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Allow Timesketch to have sketch-specific Sigma rules #3004
Comments
Hi thank you for the idea. I see where you are coming from, I would say the quickest way for this is to use saved searches instead, those are sketch specific. Sigma and the usage of Sigma rules in Timesketch and the corresponding analyzer are designed to be tool wide, so changing that would require a not trivial amount of thoughts. Hope that helps. |
Is your feature request related to a problem? Please describe.
My problem is that the Sigma rules are global for each of the sketches. In my case I have multiple unrelated timelines. I have a set of generic Sigma rules that I run on each of the timelines. Then I create Sigma rules that take into account the sketch specifics. The problem is that there is no way for me to restrict particular rules only for certain timelines. All the rules are globally available. This clogs the list of rules in the UI and makes it hard to work with sketches.
Describe the solution you'd like
Having global and sketch-specific sigma rules would be a solution to my problem. The user should be able to enter the sketch and view/create sketch-specific rules. The Sigma Analyzer should take into account this sketch-to-rule(s) relationship and run sketch-specific rules on the correct sketch.
Describe alternatives you've considered
Currently I've patched the UI to filter the list of Sigma rules based on the sketch name. This gives the desired cosmetic effect but it is a rather simplistic workaround for the sake of demo. The rules are still global.
Additional context
Here's the patch that will make the UI filter the rules:
The text was updated successfully, but these errors were encountered: