Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Placeholder value modifier expand not recognized #164

Open
r0ot opened this issue Jun 26, 2024 · 0 comments
Open

Placeholder value modifier expand not recognized #164

r0ot opened this issue Jun 26, 2024 · 0 comments

Comments

@r0ot
Copy link

r0ot commented Jun 26, 2024

The sigma language supports a value modifier called expand that allows dynamic, environment-specific values to be populated through a translation pipeline. See the blog.sigmahq.io writeup here.

When a sigma rule with this logic is attempted to be translated by uncoder the following error message is received:
Unexpected error. Unexpected token type: expand.
(Example sigma rule file: https://github.com/SigmaHQ/sigma/blob/master/rules-placeholder/cloud/azure/azure_ad_account_created_deleted_nonapproved_user.yml)

It doesn't seem to matter what output format uncoder is instructed.

Does uncoder currently support this and I'm just doing it wrong?
If so, is there documentation for it that I can't find?
If not, are there plans to implement it?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant