You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem?
I have not checked all, but many of the sigma rules in opensearch 2.10 are quite old. The screenshot below is dated 2019 - but that rule in sigmahq repo was updated last month.
What solution would you like?
It would be nice to have a mechanism to update the rules periodically pulling from the repo. Alternatively, it would be good to re-baseline the rules for future releases to use a more recent pull from sigmahq. Not sure if pulling for each release is practical - but atleast 4x a year would keep them more current/relevant.
It would also be nice in the rule listing page in the GUI to have a column that show the date the the rule was last updated. Right now you would have to click on each rule individually to see the meta info (reference the screenshot below)
What alternatives have you considered?
The alternative would be to pull the repo and use API calls to put fresh rules into our index periodically. We would need to try to match and overwrite rules with newer versions, and import newer rules.
Do you have any additional context?
The text was updated successfully, but these errors were encountered:
I would like to go one step further and update them automatically at least daily of maybe even hourly. Threats emerge fast, take log4j: in a couple of hours everyone went bananas, You really need to have your eyes on the ball in the security space.
We have a PR out that needs to be rebased to continuously update the sigma rules. #390
praveensameneni
changed the title
[FEATURE] A way to update sigma rules from the sigmahq repository from the dashboard gui
[Bug] A way to update sigma rules from the sigmahq repository from the dashboard gui
Mar 18, 2024
riysaxen-amzn
pushed a commit
to riysaxen-amzn/security-analytics
that referenced
this issue
Mar 25, 2024
Is your feature request related to a problem?
I have not checked all, but many of the sigma rules in opensearch 2.10 are quite old. The screenshot below is dated 2019 - but that rule in sigmahq repo was updated last month.
What solution would you like?
It would be nice to have a mechanism to update the rules periodically pulling from the repo. Alternatively, it would be good to re-baseline the rules for future releases to use a more recent pull from sigmahq. Not sure if pulling for each release is practical - but atleast 4x a year would keep them more current/relevant.
It would also be nice in the rule listing page in the GUI to have a column that show the date the the rule was last updated. Right now you would have to click on each rule individually to see the meta info (reference the screenshot below)
What alternatives have you considered?
The alternative would be to pull the repo and use API calls to put fresh rules into our index periodically. We would need to try to match and overwrite rules with newer versions, and import newer rules.
Do you have any additional context?
The text was updated successfully, but these errors were encountered: