Beta-testing Sigma Correlations

[Res260]

Hello, is there any code done on the pysigma side that partially implements Sigma Correlations? I'd really like to test that if possible to implement a custom QRadar backend for our detection-as-code pipeline.

I know it's not officially out yet, but I've been told on Twitter that the spec is done, so if there is some code that I could use to implement a backend that leverages sigma correlations, i'd be happy to test it, give feedback and contribute code to it if needed :)

Thanks for your awesome work!

[thomaspatzke]

There's no implementation in pySigma yet, but I will notify you here when there's something to test 😉

[Res260]

Cool, thanks. I know it's kind of weird to ask for an open-source project, but is there an ETA for this? I'm not asking to put pressure on anyone, but because I might be able to help code it on my paid time if it could help accelerate the support. I understand this is a big chunk of code to develop and I'd be more than happy to help build it :)

[thomaspatzke]

No ETA, it's my late evening project 😁

Hope to find some time in the next months. The change is indeed huge because it requires some infrastructure around it: dependency resolution between Sigma rules, extension of the query generation by some staging and templating. Usually while implementing it turns often out that things work differently than initially intended, which adds further weeks and months to such projects.

But I keep also in mind that you're eager to support these efforts and possibly come back earlier than with something beta-testable 😉

[nasbench]

Correlation are part of pySigma now. Starting from https://github.com/SigmaHQ/pySigma/releases/tag/v0.11.0