Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security Policy
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

sigma

package

Go to main page

Versions in this module

v1

v1.5.0

Jul 20, 2024

v1.4.4

Jun 5, 2024

v1.4.3

Jun 4, 2024

v1.4.2

Jun 3, 2024

v1.4.1

Mar 9, 2024

v1.4.0

Jan 2, 2024

v1.3.0

Oct 5, 2023

v1.2.0

Jul 26, 2023

v1.1.0

Jun 29, 2023

v1.0.0

Jun 11, 2023

Changes in this version

type Condition

+ func (c Condition) Position() (int, int)

type Detection

+ func (d *Detection) UnmarshalYAML(node *yaml.Node) error

type FieldMatcher

+ func (f FieldMatcher) Position() (int, int)

type Search

+ func (s Search) Position() (int, int)

v0

v0.0.1

Mar 22, 2023

Changes in this version

+ func FuzzConditionParser(data []byte) int

+ func FuzzConfigParser(data []byte) int

+ func FuzzRuleParser(data []byte) int

+ type AggregationExpr interface

+ type AggregationFunc interface

+ type AllOfIdentifier struct

+ Ident SearchIdentifier

+ type AllOfPattern struct

+ Pattern string

+ type AllOfThem struct

+ type And []SearchExpr

+ type Average struct

+ Field string

+ GroupedBy string

+ type Comparison struct

+ Func AggregationFunc

+ Op ComparisonOp

+ Threshold float64

+ type ComparisonOp string

+ var Equal ComparisonOp = "="

+ var GreaterThan ComparisonOp = ">"

+ var GreaterThanEqual ComparisonOp = ">="

+ var LessThan ComparisonOp = "<"

+ var LessThanEqual ComparisonOp = "<="

+ var NotEqual ComparisonOp = "!="

+ type Condition struct

+ Aggregation AggregationExpr

+ Search SearchExpr

+ func ParseCondition(input string) (Condition, error)

+ func (c Condition) MarshalYAML() (interface{}, error)

+ type Conditions []Condition

+ func (c *Conditions) UnmarshalYAML(node *yaml.Node) error

+ func (c Conditions) MarshalYAML() (interface{}, error)

+ type Config struct

+ Backends []string

+ DefaultIndex string

+ FieldMappings map[string]FieldMapping

+ Logsources map[string]LogsourceMapping

+ Order int

+ Placeholders map[string][]interface{}

+ Title string

+ func ParseConfig(contents []byte) (Config, error)

+ type Count struct

+ Field string

+ GroupedBy string

+ type Detection struct

+ Conditions Conditions

+ Searches map[string]Search

+ Timeframe time.Duration

+ type EventMatcher []FieldMatcher

+ func (f *EventMatcher) UnmarshalYAML(node *yaml.Node) error

+ func (f EventMatcher) MarshalYAML() (interface{}, error)

+ type FieldMapping struct

+ TargetNames []string

+ func (f *FieldMapping) UnmarshalYAML(value *yaml.Node) error

+ type FieldMatcher struct

+ Field string

+ Modifiers []string

+ Values []interface{}

+ type FileType string

+ const ConfigFile

+ const InvalidFile

+ const RuleFile

+ const UnknownFile

+ func InferFileType(contents []byte) FileType

+ func (f *FileType) UnmarshalYAML(node *yaml.Node) error

+ type Logsource struct

+ AdditionalFields map[string]interface{}

+ Category string

+ Definition string

+ Product string

+ Service string

+ type LogsourceIndexes []string

+ func (i *LogsourceIndexes) UnmarshalYAML(value *yaml.Node) error

+ type LogsourceMapping struct

+ Conditions Search

+ Index LogsourceIndexes

+ Rewrite Logsource

+ type Max struct

+ Field string

+ GroupedBy string

+ type Min struct

+ Field string

+ GroupedBy string

+ type Near struct

+ Condition SearchExpr

+ type Not struct

+ Expr SearchExpr

+ type OneOfIdentifier struct

+ Ident SearchIdentifier

+ type OneOfPattern struct

+ Pattern string

+ type OneOfThem struct

+ type Or []SearchExpr

+ type RelatedRule struct

+ ID string

+ Type string

+ type Rule struct

+ AdditionalFields map[string]interface{}

+ Author string

+ Description string

+ Detection Detection

+ ID string

+ Level string

+ Logsource Logsource

+ References []string

+ Related []RelatedRule

+ Status string

+ Tags []string

+ Title string

+ func ParseRule(input []byte) (Rule, error)

+ type Search struct

+ EventMatchers []EventMatcher

+ Keywords []string

+ func (s *Search) UnmarshalYAML(node *yaml.Node) error

+ func (s Search) MarshalYAML() (interface{}, error)

+ type SearchExpr interface

+ type SearchIdentifier struct

+ Name string

+ type Sum struct

+ Field string

+ GroupedBy string