Skip to content

Commit

Permalink
small update
Browse files Browse the repository at this point in the history
  • Loading branch information
nasbench committed Aug 5, 2024
1 parent 3c3bf28 commit 599518a
Show file tree
Hide file tree
Showing 2 changed files with 30 additions and 8 deletions.
4 changes: 4 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -60,3 +60,7 @@ Here's what you can expect from each of the main subfolders within this repo. Pl
* [SigmaHQ Rule Convention](/sigmahq/sigmahq-rule-convention.md)
* [SigmaHQ Filename Convention](/sigmahq/sigmahq-filename-convention.md)
* [SigmaHQ Title Convention](/sigmahq/sigmahq-title-convention.md)

## Version 2 Changes

You can read more on the potential breaking changes and additional features introduced in version 2.0.0 of the specification [here](version-2-changes.md)
34 changes: 26 additions & 8 deletions version-2-changes.md
Original file line number Diff line number Diff line change
@@ -1,23 +1,41 @@
# Changes and Feature Introduced in V2.0.0

The following is a non-exhaustive list of changes between the v1 and v2 specification.

# Sigmac
## Sigmac

As of August 1st 2024 the `sigmac` toolchain has reached it's end of life, and its corresponding [repository](https://github.com/SigmaHQ/legacy-sigmatools) has been archived. The `sigmac` toolchain doesn't take into account new feature introduced in the second version specification.

The `pySigma` library and it's corresponding command line interface `sigma-cli`, provide full support for version 2 of the specification.

# Date
## Date & Modified Field

The latest version of the specification drops support for the date format using a slash `/` separator (YYYY/MM/DD), and now it only recommend the usage of the ISO 8601 format with the a `-` separator (YYYY-MM-DD).

# Modifiers
## Tags Field

The latest version of the specification changed the use of "underscore" and "dots" in favour of "dashes" for the following tag namespaces:

* ATT&CK
* CVE
* Detection

## Related Field

The related field type `obsoletes` has been changed to `obsolete` for consistency purposes.

## Rx Schema

The latest version of the specification drops the support for the Rx-Schema in favour of a [JSON schema](/json-schema/).

## Modifiers

The latest version of the specification and by extension the `pySigma` library, introduces a new set of modifier. You can check the full list of all supported modifiers in the [modifiers appendix](./appendix/appendix_modifiers.md).
The latest version of the specification and by extension the `pySigma` library, introduces a new set of modifier. You can check the full list of all currently supported modifiers in the [Sigma Modifiers Appendix](./appendix/sigma-modifiers-appendix.md).

# Correlation
## Correlation

The latest version of the specification drops the usage of the old aggregation expression, in favour of a new format titles meta rules. Check out the [Sigma Meta Rules Specification](/sigma_meta_rules.md) files for a detailed description of the format.
The latest version of the specification drops the usage of the old aggregation expression, in favour of a new format titled meta/correlation rules. Check out the [Sigma Correlation Rules Specification](/specification/sigma-correlation-rules-specification.md) for full details.

# Sigma Filters
## Sigma Filters

Check out the [Sigma Meta Filter Specification](/Sigma_meta_filter.md) for a detailed description of the format.
Check out the [Sigma Filters Specification](/specification/sigma-filters-specification.md) for a detailed description of the format.

0 comments on commit 599518a

Please sign in to comment.