Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] A way to update sigma rules from the sigmahq repository from the dashboard gui #659

Open
tallyoh opened this issue Oct 11, 2023 · 3 comments
Labels
enhancement New feature or request

Comments

@tallyoh
Copy link

tallyoh commented Oct 11, 2023

Is your feature request related to a problem?
I have not checked all, but many of the sigma rules in opensearch 2.10 are quite old. The screenshot below is dated 2019 - but that rule in sigmahq repo was updated last month.

What solution would you like?
It would be nice to have a mechanism to update the rules periodically pulling from the repo. Alternatively, it would be good to re-baseline the rules for future releases to use a more recent pull from sigmahq. Not sure if pulling for each release is practical - but atleast 4x a year would keep them more current/relevant.

It would also be nice in the rule listing page in the GUI to have a column that show the date the the rule was last updated. Right now you would have to click on each rule individually to see the meta info (reference the screenshot below)

What alternatives have you considered?
The alternative would be to pull the repo and use API calls to put fresh rules into our index periodically. We would need to try to match and overwrite rules with newer versions, and import newer rules.

Do you have any additional context?
image

@tallyoh tallyoh added enhancement New feature or request untriaged labels Oct 11, 2023
@sandervandegeijn
Copy link

I would like to go one step further and update them automatically at least daily of maybe even hourly. Threats emerge fast, take log4j: in a couple of hours everyone went bananas, You really need to have your eyes on the ball in the security space.

@praveensameneni
Copy link
Member

We have a PR out that needs to be rebased to continuously update the sigma rules.
#390

@praveensameneni praveensameneni changed the title [FEATURE] A way to update sigma rules from the sigmahq repository from the dashboard gui [Bug] A way to update sigma rules from the sigmahq repository from the dashboard gui Mar 18, 2024
riysaxen-amzn pushed a commit to riysaxen-amzn/security-analytics that referenced this issue Mar 25, 2024
Signed-off-by: Surya Sashank Nistala <[email protected]>

Signed-off-by: Surya Sashank Nistala <[email protected]>
(cherry picked from commit f842a046f4970e81b215fd650da38cec784a21ab)

Co-authored-by: Surya Sashank Nistala <[email protected]>
@goyamegh
Copy link
Collaborator

Latest rules were updated manually too: #942

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

4 participants