EQL Query Generation Modules #346
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This pull request introduces 4 alerts when merging dc4c09f into d0ddfb3 - view on LGTM.com new alerts:
|
Codecov Report
@@ Coverage Diff @@
## master #346 +/- ##
==========================================
+ Coverage 18.58% 18.69% +0.11%
==========================================
Files 96 98 +2
Lines 7916 7984 +68
==========================================
+ Hits 1471 1493 +22
- Misses 6445 6491 +46
Continue to review full report at Codecov.
|
|
Thank you very much, this is a great contribution! If you have the time to update the documentation of the modules that would be great and show the availability of the modules to other users. |
|
Will do, I’ll get that updated tomorrow. I have some more functionality to
add to those endgame modules so I’ll just put up another pull request when
they’re ready again. Thanks a ton for taking the changes! I’m really
excited!
V/r
Braden Laverick
…On Wed, Oct 30, 2019 at 16:09 Alexandre Dulaunoy ***@***.***> wrote:
Thank you very much, this is a great contribution! If you have the time to
update the documentation of the modules that would be great and show the
availability of the modules to other users.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#346?email_source=notifications&email_token=AEVPGFFSRFXESQZHYAUT5WTQRHZW7A5CNFSM4JGZVOTKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOECVYXTI#issuecomment-548113357>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AEVPGFAC7XOWS6OW73GPXVDQRHZW7ANCNFSM4JGZVOTA>
.
|
|
Woah, awesome! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I've added two new files to the project: eql.py in expansion/ and endgame_export.py in export_mod/. Both of these files describe modules that generate Event Query Language directly from MISP events. This is useful for SOCs that also use Endgame, since they can copy/paste the queries directly to search for that particular MISP event. eql.py is a single attribute "wrapper" enrichment that makes a single EQL query. mass_eql_export is an export module that takes all Endgame-relevant attributes and generates a large EQL for all of them. This is the first version, and will have improvements over time. Here is a link to a reference for EQL: https://eql.readthedocs.io/