Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: count up Event with hits when aggregation/correlation rule #1384

Merged
merged 15 commits into from
Jul 15, 2024
Merged

fix: count up Event with hits when aggregation/correlation rule #1384

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
79ce661
refactor: remove unused fields/params
fukusuket Jul 7, 2024
2b60013
fix: count up events when agg/correlation rule matched event
fukusuket Jul 8, 2024
12b3f6e
chg: output channel/event_id/computer when agg/correlation result
fukusuket Jul 9, 2024
ff28335
chg: output channel/event_id/computer when agg/correlation result
fukusuket Jul 9, 2024
932674d
chg: output channel/event_id/computer when agg/correlation result
fukusuket Jul 9, 2024
23fe401
chg: sort computer/event_id/channel multiple val
fukusuket Jul 9, 2024
c55e3e9
chg: sort computer/event_id/channel multiple val
fukusuket Jul 9, 2024
d1ea60e
refactor: remove duplicated code
fukusuket Jul 9, 2024
e0a90a5
chg: output evtx_file_path when agg/correlation rule
fukusuket Jul 10, 2024
a8f9236
fix: Top 5 computers with most unique detections's output
fukusuket Jul 10, 2024
80d219d
fix: Top 5 computers with most unique detections's output
fukusuket Jul 10, 2024
d69134a
fix: remove debug print
fukusuket Jul 11, 2024
b641517
update changelog
YamatoSecurity Jul 14, 2024
11dffd1
bump
YamatoSecurity Jul 14, 2024
62454b9
fix: channel abbreviation
fukusuket Jul 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions CHANGELOG-Japanese.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,11 @@
- `Data`フィールドは、すべて`Data`フィールドとして、またはJSONの配列としてではなく、インデックス化された文字列として表示されるようになった。(#1371) (@fukusuket)
- 前: `"Data": ["17514", "Multiprocessor Free", "Service Pack 1"]`
- 後: `"Data[3]": "17514", "Data[4]": "Multiprocessor Free", "Data[5]": "Service Pack 1"`
- 集計ルールのアラートに、複数の結果がある場合でも`Channel`と`EventID`の情報が表示されるようにした。 (#1342) (@fukusuket)

**バグ修正:**
- Sigmaの相関ルールのカウントが`Events with hits`に表示されていなかった。(#1373) (@fukusuket)
- 集計ルールのカウントが`Events with hits`に表示されていなかった。(#1375) (@fukusuket)

## 2.16.0 [2024/06/11]

Expand Down
5 changes: 5 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,11 @@
- `Data` fields are now displayed as indexed strings instead of as all `Data` fields or in an array for JSON. (#1371) (@fukusuket)
- Before: `"Data": ["17514", "Multiprocessor Free", "Service Pack 1"]`
- After: `"Data[3]": "17514", "Data[4]": "Multiprocessor Free", "Data[5]": "Service Pack 1"`
- Aggregation rule alerts now show `Channel` and `EventID` information even when there are multiple results. (#1342) (@fukusuket)

**Bug Fixes:**
- Sigma correlation rule count was not showing up in `Events with hits`. (#1373) (@fukusuket)
- Aggregation condition rule count was not showing up in `Events with hits`. (#1375) (@fukusuket)

## 2.16.0 [2024/06/11]

Expand Down
Loading
Loading