grafana / pySigma-backend-loki

pySigma backend for generating Grafana Loki/LogQL rules

grafana/pySigma-backend-loki Issues

Update backend to support Sigma Correlations
Closed 2 months ago2
Create pipeline transformation to simplify customizing log stream selectors
Closed 2 months ago
Sigma rule modifier `endswith` is not exported to LogQL
Closed 3 months ago2
Adding Line Filters before parsers results in an erroneous pipe
Closed 3 months ago2
Update backend to support Sigma Filters
Closed 3 months ago2
Implement Sigma Correlations to convert Sigma correlation rules to supported metric queries
Closed 3 months ago5
Investigate mapping of LogQL metric queries to Sigma Correlation
Closed 3 months ago1
Correctly support the case-insensitive condition modifier
Updated 4 months ago2
Certain modifiers raise exceptions
Closed 4 months ago1
Add support for `fieldref` modifier
Closed 5 months ago
Add support for `or` in line filters
Updated 7 months ago
Change the `case_insensitive` argument to `case_sensitive`
Closed 7 months ago
Update to latest version of pySigma v0.11
Closed 7 months ago
Improve backend documentation
Updated 9 months ago
Update Okta pipeline to reflect field names
Closed 9 months ago1
Loki does not handle condition lists in the manner other backends do
Closed a year ago2
Split out negation behaviour into a new TextQueryBackend subclass
Updated a year ago
Release new version for pySigma 0.10.0
Closed a year ago
Ensure W3C field names are mapped correctly in relevant pipelines
Closed a year ago
Case sensitivity in generated LogQL queries
Closed a year ago2
Add unit test for pySigma autodiscover functionality
Closed a year ago
Attempt to shorten OR'd field regexes into a single condition
Updated 2 years ago
Refactor loki.py for ease of comprehension
Closed 2 years ago
Update to pySigma 0.9.0
Closed 2 years ago
Refactor Loki parse tree adjustments as a separate stage of backend
Closed 2 years ago
Loki matching behaviour on case-insensitive wildcarded line filters
Closed 2 years ago2
Negated ANDs not being grouped correctly
Closed 2 years ago
Use `fnmatch.translate` for converting wildcards (globs) to regex
Closed 2 years ago2
Move comments into the docstring
Updated 2 years ago