You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
contains|expand and expand are the last modifiers that are used by rules but are not supported.
This modifier is more difficult than the others because custom lists need to be created beforehand in order to use them.
Since these lists will need to be created on the user's end, I want to place them in the ./config/expand/ directory instead of ./rules/config/expand as we will not need to dynamically upload them.
Example rule:
detection:
selection:
EventID: 5145
RelativeTargetName|contains: '\winreg'
filter_main:
IpAddress|expand: '%Admins_Workstations%'
condition: selection and not filter_main
If the ./config/expand/Admins_Workstations.txt file exists, then Hayabusa will replace the placeholder %Admins_Workstations% with every string inside this text file. There can be multiple values inside the text file, so for example if there are 5 admin workstation names in the text file, then essentially Hayabusa will use 5 different variations of this rule.
For example, it will essentially check the same logic as:
By default, since the expand config files need to be created, there should be 0 enabled expand rules.
I am thinking about creating 2 expand commands: One to list up the expand placeholder names and one to create lists to use in the expand config files. I will create separate issues for these.
@fukusuket This one is a little difficult, but do you think you could do this one?
The text was updated successfully, but these errors were encountered:
contains|expand
andexpand
are the last modifiers that are used by rules but are not supported.This modifier is more difficult than the others because custom lists need to be created beforehand in order to use them.
Current list of expand possibilities:
Since these lists will need to be created on the user's end, I want to place them in the
./config/expand/
directory instead of./rules/config/expand
as we will not need to dynamically upload them.Example rule:
If the
./config/expand/Admins_Workstations.txt
file exists, then Hayabusa will replace the placeholder%Admins_Workstations%
with every string inside this text file. There can be multiple values inside the text file, so for example if there are 5 admin workstation names in the text file, then essentially Hayabusa will use 5 different variations of this rule.For example, it will essentially check the same logic as:
As of now, the only variation of
expand
iscontains|expand
but we should also probably supportstartswith|expand
andendswith|expand
as well.If
./config/expand/Admins_Workstations.txt
does NOT exist, then Hayabusa will just ignore this rule.We should add the number of loaded "expand rules":
By default, since the expand config files need to be created, there should be 0 enabled expand rules.
I am thinking about creating 2
expand
commands: One to list up the expand placeholder names and one to create lists to use in the expand config files. I will create separate issues for these.@fukusuket This one is a little difficult, but do you think you could do this one?
The text was updated successfully, but these errors were encountered: