Implement Sigma Correlations to convert Sigma correlation rules to supported metric queries

Question

Implement Sigma Correlations to convert Sigma correlation rules to supported metric queries

mostafa opened this issue 6 months ago · 5 comments

This implementation ticket follows the investigation ticket that maps the Sigma correlation rules to supported metric queries.

Tasks

Beta Give feedback

Implement the feature
Write tests
Release a new version
Add supported capabilities to the pySigma-plugin-directory repo
Options

Answer 1 · 2024-06-26T10:30:37.000Z

Duplicate of #124? Why did we need this additional issue that just seems to hide the context and add these issues to the task list on #124?

Answer 2 · 2024-07-01T07:55:27.000Z

@kelnage I thought of #124 as an epic and I broke it down into two separate spike (investigation) and implementation tickets, just like we do for many other epics.

Answer 3 · 2024-07-01T13:04:35.000Z

During our last team retro, some expressed frustration about the nested nature of our epics - so I think unless there's a strong motivation for breaking it down further, keeping the tasks within a single epic makes more sense. Especially here - most of these these tasks are completely generic or redundant (releasing a new version doesn't require a new task).

Answer 4 · 2024-07-01T13:07:47.000Z

Sounds good! I'll merge them into the same ticket.

Answer 5 · 2024-07-01T13:09:14.000Z

Closed in favor of #124.