Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ES and Readme from SOC Prime #990

Merged
merged 5 commits into from
Aug 25, 2020
Merged

Conversation

neu5ron
Copy link
Contributor

@neu5ron neu5ron commented Aug 25, 2020

  • elastic backend adds ability to use an analyzed field / different field for if a value contains wildcard (also will prepare for new wildcard data type usage)
    -elastic backend tweaks for if a sub field was set as an analyzed field or different type (other than keyword) to still be applied if both keyword and that field were sub fields. Scenarios of 3 or more field types.....
  • elastic backend escape / don't escape logic for '.' in regex and case insensitivity
  • update elastic sigmac readme to support new wildcard backend option as well as some cleanup of the readme

…/value contains a wildcard.

Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com>
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com>
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com>
Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com>
…/value contains a wildcard.

Signed-off-by: Nate Guagenti <neu5ron@users.noreply.github.com>
@thomaspatzke thomaspatzke merged commit b742e4e into SigmaHQ:master Aug 25, 2020
@neu5ron neu5ron deleted the es_backend branch September 16, 2021 16:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants