pySigma Google Secops Beta Release

🎉 Release Notes: v0.1.0

📌 Summary

This release marks a significant milestone for the pySigma Google SecOps (Chronicle) Backend, introducing major improvements in event type determination, field mappings, and output formats. We've enhanced the backend's ability to generate more accurate and flexible queries, while also introducing support for YARA-L 2.0 output.

🚀 New Features

🧠 Advanced Event Type Determination

• Implemented SetRuleEventTypeFromLogsourceTransformation and SetRuleEventTypeFromEventIDTransformation
• Improved logic to determine event types based on logsource categories and EventIDs

🗺️ Dynamic Field Mapping

• Introduced get_field_mappings_by_event_type function for more flexible field mappings
• Added support for various event types including process, network, file, authentication, and registry events

📤 YARA-L 2.0 Output Support

• Added new yara_l_pipeline() for generating YARA-L 2.0 format output
• Implemented YaraLPostprocessingTransformation for formatting YARA-L rules

🔄 Enum Value Conversion

• New ConvertEnumValueTransformation to map enum values to their UDM equivalents

🔧 Improvements

📊 Pipeline Enhancements

• Added PrependMetadataPostprocessingTransformation for more flexible query generation
• Implemented SetPrependMetadataTransformation to control metadata prepending
• New RemoveHashAlgoFromValueTransformation for cleaning up hash fields

🧹 Code Cleanup and Optimization

• Refactored and optimized various utility functions
• Improved overall code structure and readability

🐛 Error Handling

• Enhanced error reporting for invalid UDM fields

🧪 Testing

• Added comprehensive test suite for the SecOps pipeline
• Expanded backend tests to cover new functionalities, including YARA-L output

📚 Documentation

• Updated README with new features and usage examples
• Added more detailed comments and docstrings throughout the codebase

🔮 Coming Soon

• More robust field mapping logic
• Enhanced YARA-L output with improved readability and structure