You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The sigma language supports a value modifier called expand that allows dynamic, environment-specific values to be populated through a translation pipeline. See the blog.sigmahq.io writeup here.
It doesn't seem to matter what output format uncoder is instructed.
Does uncoder currently support this and I'm just doing it wrong?
If so, is there documentation for it that I can't find?
If not, are there plans to implement it?
The text was updated successfully, but these errors were encountered:
The sigma language supports a value modifier called
expand
that allows dynamic, environment-specific values to be populated through a translation pipeline. See the blog.sigmahq.io writeup here.When a sigma rule with this logic is attempted to be translated by uncoder the following error message is received:
Unexpected error. Unexpected token type: expand
.(Example sigma rule file: https://github.com/SigmaHQ/sigma/blob/master/rules-placeholder/cloud/azure/azure_ad_account_created_deleted_nonapproved_user.yml)
It doesn't seem to matter what output format uncoder is instructed.
Does uncoder currently support this and I'm just doing it wrong?
If so, is there documentation for it that I can't find?
If not, are there plans to implement it?
The text was updated successfully, but these errors were encountered: