Skip to content

Commit bfe4080

Browse files
ziadhanyziadhany
committed
Update sigma rules models
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
1 parent 8713e07 commit bfe4080

6 files changed

Lines changed: 401 additions & 87 deletions

File tree

‎vulnerabilities/api_v2.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1402,7 +1402,7 @@ def lookup(self, request):
14021402

14031403

14041404
class DetectionRuleFilter(filters.FilterSet):
1405-
advisory_avid = filters.CharFilter(field_name="advisory__avid", lookup_expr="exact")
1405+
advisory_avid = filters.CharFilter(field_name="related_advisories__avid", lookup_expr="exact")
14061406

14071407
rule_text_contains = filters.CharFilter(field_name="rule_text", lookup_expr="icontains")
14081408

‎vulnerabilities/improvers/__init__.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,9 @@
7575
compute_advisory_todo.ComputeToDo,
7676
collect_ssvc_trees.CollectSSVCPipeline,
7777
relate_severities.RelateSeveritiesPipeline,
78-
sigma_rules.SigmaRulesImproverPipeline,
78+
sigma_rules.SigmaHQImproverPipeline,
79+
sigma_rules.SigmaSamuraiMDRImproverPipeline,
80+
sigma_rules.SigmaMbabinskiImproverPipeline,
81+
sigma_rules.P4T12ICKSigmaImproverPipeline,
7982
]
8083
)

‎vulnerabilities/pipelines/v2_improvers/sigma-schema.json‎

Lines changed: 255 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,255 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema#",
3+
"title": "Sigma rule specification V2.0.0 (2024-08-08)",
4+
"type": "object",
5+
"required": ["title", "logsource", "detection"],
6+
"properties": {
7+
"title": {
8+
"type": "string",
9+
"maxLength": 256,
10+
"description": "A brief title for the rule that should contain what the rules is supposed to detect"
11+
},
12+
"id": {
13+
"type": "string",
14+
"description": "A globally unique identifier for the Sigma rule. This is recommended to be a UUID v4, but not mandatory.",
15+
"format": "uuid"
16+
},
17+
"related": {
18+
"type": "array",
19+
"description": "A list of related Sigma rules to keep track of the relationships between detections. This can be used to indicate that a rule is derived from another rule, or that a rule has been obsoleted by another rule.",
20+
"items": {
21+
"type": "object",
22+
"required": ["id", "type"],
23+
"properties": {
24+
"id": {
25+
"type": "string",
26+
"description": "A globally unique identifier for the Sigma rule. This is recommended to be a UUID v4, but not mandatory.",
27+
"format": "uuid"
28+
},
29+
"type": {
30+
"type": "string",
31+
"oneOf": [
32+
{
33+
"const": "derived",
34+
"description": "The rule was derived from the referred rule or rules, which may remain active"
35+
},
36+
{
37+
"const": "obsolete",
38+
"description": "The rule obsoletes the referred rule or rules, which aren't used anymore"
39+
},
40+
{
41+
"const": "merged",
42+
"description": "The rule was merged from the referred rules. The rules may be still existing and in use"
43+
},
44+
{
45+
"const": "renamed",
46+
"description": "The rule had previously the referred identifier or identifiers but was renamed for whatever reason, e.g. from a private naming scheme to UUIDs, to resolve collisions etc. It's not expected that a rule with this id exists anymore"
47+
},
48+
{
49+
"const": "similar",
50+
"description": "Use to relate similar rules to each other (e.g. same detection content applied to different log sources, rule that is a modified version of another rule with a different level)"
51+
}
52+
]
53+
}
54+
}
55+
}
56+
},
57+
"name": {
58+
"type": "string",
59+
"maxLength": 256,
60+
"description": "a unique human-readable name that can be used instead of the id as a reference in correlation rules"
61+
},
62+
"taxonomy":{
63+
"type": "string",
64+
"maxLength": 256,
65+
"description": "Defines the taxonomy used in the Sigma rule"
66+
},
67+
"status": {
68+
"type": "string",
69+
"oneOf": [
70+
{
71+
"const": "stable",
72+
"description": "The rule didn't produce any obvious false positives in multiple environments over a long period of time"
73+
},
74+
{
75+
"const": "test",
76+
"description": "The rule doesn't show any obvious false positives on a limited set of test systems"
77+
},
78+
{
79+
"const": "experimental",
80+
"description": "A new rule that hasn't been tested outside of lab environments and could lead to many false positives"
81+
},
82+
{
83+
"const": "deprecated",
84+
"description": "The rule was replaced or is now covered by another one. The link between both rules is made via the `related` field"
85+
},
86+
{
87+
"const": "unsupported",
88+
"description": "The rule can not be used in its current state (special correlation log, home-made fields, etc.)"
89+
}
90+
]
91+
},
92+
"description": {
93+
"type": "string",
94+
"description": "A short description of the rule and the malicious activity that can be detected",
95+
"maxLength": 65535
96+
},
97+
"license": {
98+
"type": "string",
99+
"description": "License of the rule according the SPDX ID specification (https://spdx.dev/ids/)"
100+
},
101+
"author": {
102+
"type": "string",
103+
"description": "Creator of the rule. (can be a name, nickname, twitter handle, etc.)"
104+
},
105+
"references": {
106+
"type": "array",
107+
"description": "References to the source that the rule was derived from. These could be blog articles, technical papers, presentations or even tweets",
108+
"uniqueItems": true,
109+
"items": {
110+
"type": "string"
111+
}
112+
},
113+
"date": {
114+
"type": "string",
115+
"description": "Creation date of the rule. Use the ISO 8601 format YYYY-MM-DD",
116+
"pattern": "^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$"
117+
},
118+
"modified": {
119+
"type": "string",
120+
"description": "Last modification date of the rule. Use the ISO 8601 format YYYY-MM-DD",
121+
"pattern": "^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$"
122+
},
123+
"logsource": {
124+
"type": "object",
125+
"description": "The log source that the rule is supposed to detect malicious activity in.",
126+
"properties": {
127+
"category": {
128+
"description": "Group of products, like firewall or process_creation",
129+
"type": "string"
130+
},
131+
"product": {
132+
"description": "A certain product, like windows",
133+
"type": "string"
134+
},
135+
"service": {
136+
"description": "A subset of a product's logs, like sshd",
137+
"type": "string"
138+
},
139+
"definition":{
140+
"description": "can be used to describe the log source",
141+
"type": "string"
142+
}
143+
}
144+
},
145+
"detection": {
146+
"type": "object",
147+
"required": ["condition"],
148+
"description": "A set of search-identifiers that represent properties of searches on log data",
149+
"additionalProperties": {
150+
"description": "A Search Identifier: A definition that can consist of two different data structures - lists and maps.",
151+
"anyOf": [
152+
{
153+
"type": "array",
154+
"items": {
155+
"anyOf": [
156+
{
157+
"type": "string"
158+
},
159+
{
160+
"type": "integer"
161+
},
162+
{
163+
"type": "object",
164+
"items": {
165+
"type": "string"
166+
}
167+
}
168+
]
169+
}
170+
},
171+
{
172+
"type": "object",
173+
"items": {
174+
"type": "string"
175+
}
176+
}
177+
]
178+
},
179+
"properties": {
180+
"condition": {
181+
"type": "string",
182+
"description": "The relationship between the search identifiers to create the detection logic. Ex: selection1 or selection2"
183+
}
184+
}
185+
},
186+
"fields": {
187+
"type": "array",
188+
"description": "A list of log fields that could be interesting in further analysis of the event and should be displayed to the analyst",
189+
"uniqueItems": true,
190+
"items": {
191+
"type": "string"
192+
}
193+
},
194+
"falsepositives": {
195+
"description": "A list of known false positives that may occur",
196+
"uniqueItems": true,
197+
"anyOf": [
198+
{
199+
"type": "string",
200+
"minLength": 2
201+
},
202+
{
203+
"type": "array",
204+
"items": {
205+
"type": "string",
206+
"minLength": 2
207+
}
208+
}
209+
]
210+
},
211+
"level": {
212+
"type": "string",
213+
"description": "The criticality of a triggered rule",
214+
"oneOf": [
215+
{
216+
"const": "informational",
217+
"description": "Rule is intended for enrichment of events, e.g. by tagging them. No case or alerting should be triggered by such rules because it is expected that a huge amount of events will match these rules"
218+
},
219+
{
220+
"const": "low",
221+
"description": "Notable event but rarely an incident. Low rated events can be relevant in high numbers or combination with others. Immediate reaction shouldn't be necessary, but a regular review is recommended"
222+
},
223+
{
224+
"const": "medium",
225+
"description": "Relevant event that should be reviewed manually on a more frequent basis"
226+
},
227+
{
228+
"const": "high",
229+
"description": "Relevant event that should trigger an internal alert and requires a prompt review"
230+
},
231+
{
232+
"const": "critical",
233+
"description": "Highly relevant event that indicates an incident. Critical events should be reviewed immediately. It is used only for cases in which probability borders certainty"
234+
}
235+
]
236+
},
237+
"tags": {
238+
"description": "Tags to categorize a Sigma rule.",
239+
"type": "array",
240+
"uniqueItems": true,
241+
"items": {
242+
"type": "string",
243+
"pattern": "^[a-z0-9_-]+\\.[a-z0-9._-]+$"
244+
}
245+
},
246+
"scope":{
247+
"description": "A list of intended scope of the rule",
248+
"type": "array",
249+
"items": {
250+
"type": "string",
251+
"minLength": 2
252+
}
253+
}
254+
}
255+
}

0 commit comments

Comments
 (0)