Skip to content

Commit

Permalink
Allow special characters in startswith, endswith and contains express…
Browse files Browse the repository at this point in the history
…ions
  • Loading branch information
thomaspatzke committed Oct 14, 2024
1 parent ad0dc16 commit e573e82
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions sigma/backends/crowdstrike/logscale.py
Original file line number Diff line number Diff line change
Expand Up @@ -151,14 +151,20 @@ class LogScaleBackend(TextQueryBackend):

# wildcards could have been used here as well but we went with the regex format without the case insensitivity flag
case_sensitive_startswith_expression: ClassVar[str] = "{field}=/^{value}/"
case_sensitive_startswith_expression_allow_special: ClassVar[bool] = True
case_sensitive_endswith_expression: ClassVar[str] = "{field}=/{value}$/"
case_sensitive_endswith_expression_allow_special: ClassVar[bool] = True
case_sensitive_contains_expression: ClassVar[str] = "{field}=/{value}/"
case_sensitive_contains_expression_allow_special: ClassVar[bool] = True

# also handled as regex. Look at the convert_condition_field_eq_val_str method
eq_expression: ClassVar[str] = "{field}=/^{regex}$/i"
startswith_expression: ClassVar[str] = "{field}=/^{regex}/i"
startswith_expression_allow_special: ClassVar[bool] = True
endswith_expression: ClassVar[str] = "{field}=/{regex}$/i"
endswith_expression_allow_special: ClassVar[bool] = True
contains_expression: ClassVar[str] = "{field}=/{regex}/i"
contains_expression_allow_special: ClassVar[bool] = True

# https://library.humio.com/data-analysis/functions-cidr.html
# Convert method is overloaded below
Expand Down

0 comments on commit e573e82

Please sign in to comment.