You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Originally posted by barvhaim December 6, 2022
Hello, I am migrating the STIX backend to pySigma, in order to translate rules includes not x, we don't have NOT (x) in the language but we have to modify the eq expression to != instead of =,
sel:
fieldA: valueA
fieldB: valueB
so in case of sel, I expect to fieldA = 'valueA' AND fieldB = 'valueB'
and in case of not sel, I expect to fieldA != 'valueA' OR fieldB != 'valueB'
Discussed in #80
Originally posted by barvhaim December 6, 2022
Hello, I am migrating the STIX backend to pySigma, in order to translate rules includes
not x
, we don't have NOT (x) in the language but we have to modify the eq expression to!=
instead of=
,so in case of
sel
, I expect tofieldA = 'valueA' AND fieldB = 'valueB'
and in case of
not sel
, I expect tofieldA != 'valueA' OR fieldB != 'valueB'
(and the other way around with OR cases)
How do you recommend to do such translation?
we do control the nodes in the Sigmac version (https://github.com/SigmaHQ/sigma/blob/8fa8a7355141b525f5764ad5ff86caf6afc641c7/tools/sigma/backends/stix.py#L143), but wonder what would be the best way to implement that in the new pySigma
The text was updated successfully, but these errors were encountered: