Open
Description
The sigma language supports a value modifier called expand
that allows dynamic, environment-specific values to be populated through a translation pipeline. See the blog.sigmahq.io writeup here.
When a sigma rule with this logic is attempted to be translated by uncoder the following error message is received:
Unexpected error. Unexpected token type: expand
.
(Example sigma rule file: https://github.com/SigmaHQ/sigma/blob/master/rules-placeholder/cloud/azure/azure_ad_account_created_deleted_nonapproved_user.yml)
It doesn't seem to matter what output format uncoder is instructed.
Does uncoder currently support this and I'm just doing it wrong?
If so, is there documentation for it that I can't find?
If not, are there plans to implement it?
Metadata
Metadata
Assignees
Labels
No labels