Skip to content

Placeholder value modifier expand not recognized #164

Open
@r0ot

Description

@r0ot

The sigma language supports a value modifier called expand that allows dynamic, environment-specific values to be populated through a translation pipeline. See the blog.sigmahq.io writeup here.

When a sigma rule with this logic is attempted to be translated by uncoder the following error message is received:
Unexpected error. Unexpected token type: expand.
(Example sigma rule file: https://github.com/SigmaHQ/sigma/blob/master/rules-placeholder/cloud/azure/azure_ad_account_created_deleted_nonapproved_user.yml)

It doesn't seem to matter what output format uncoder is instructed.

Does uncoder currently support this and I'm just doing it wrong?
If so, is there documentation for it that I can't find?
If not, are there plans to implement it?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions