-
Notifications
You must be signed in to change notification settings - Fork 207
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support Ordered Temporal Proximity correlation #1447
Comments
@fukusuket Since you are now the correlations rules master, 😉 can I ask you to do this one too? I will send you a sample evtx file to test with over slack.
Results:
Now, we just need to change
but does not work in this order:
since there are only 4 days left until release don't worry about rushing. We can include this in the next 3.1 release if it will take time. |
Support Ordered Temporal Proximity correlation
https://github.com/SigmaHQ/sigma-specification/blob/main/specification/sigma-correlation-rules-specification.md#ordered-temporal-proximity-temporal_ordered
Sample rule:
The text was updated successfully, but these errors were encountered: