v0.2.5

Changelog

4db655b Promote tags to a first-class field in Rule
cded470 Add minimal Fuzz harness for evaluator
f9f0a75 Add a basic evaluator.Matches benchmark

v0.2.4

Changelog

5122d62 Add InferFileType helper function (#6)

v0.2.3

Changelog

8ee67d2 🐛 Fix bug where a '$.name' mapping behaved differently to just 'name'

v0.2.2

Changelog

f103bec Improve sigmac's file detection logic so it ignore non-Sigma files
1ab394a Use sanity-io/litter in sigmac to generate pre-parsed Go files
942dcb2 Switch RelevantToEvent method over to new Event type
82c59c2 Fix Homebrew tap config

v0.2.0

Changelog

cbf6f09 ✨ Return a richer response to Matches() that includes sub-results
645dc69 ✨ Add support for logsource conditions
9db07fc Plumb errors through the aggregators and surface to the caller (#4)
c528b15 🐛 Fix missed aggregation/grouped-by fields in conversion to AST

v0.1.2

Changelog

36a372f Remove leftover debug fmt.Println
77c94b0 Add really basic fuzz harnesses

v0.1.1

Changelog

252e5f9 Add support for sigmac to parse Config files and include them in sigma.go (#2)
f07dede Add (out-of-spec) support for JSONPath in fieldmappings (#1)

v0.1.0

Changelog

81247ec Implement (One|All) Of (Them|Pattern) condition operators
8fd532f Add basic support for FieldMappings
8e879b2 Add basic evaluation of indexes in config files
307d64b Move evaluator to its own folder
8ee1349 Add basic config parser
d8b740c Add a sliding Average and Sum implementation
02a6156 Re-work AggregationKey -> GroupedByValues and provide a better in-memory count implementation
69cbacc Make aggregation expressions more AST-like
cf0e4ae Fix build status badge

v0.0.1

Changelog

62aae1f Initial release