Logsources, lack of machine readable definition of log sources (and additional requirements) about sigma HOT 4 CLOSED

Hey,

Your request is reasonable. What you can use to start is to use this https://github.com/SigmaHQ/sigma/blob/master/tests/logsource.json. Which is a file we use for the CI pipelines. It contains information about product, service and category (should be a very good start)

Other than that you're more than welcome (and encouraged) to create one if the above doesn't fit your need and maybe contribute it back in the specification repo :D

from sigma.

@MrSeccubus i'll be closing this issue as resolved soon if you have no further questions :)

from sigma.

Just one question and then I guess I should start writing ;)
What would be the best location for the file? I would suggest: documentation/logsource-guides/logsources.json in the main rule repo.

from sigma.

Currently that file is used for testing only and the logsource-guides is still a work in progress for now.

Eventually we will move a better version there i suppose to help cases like the ones you described :D

Its just taking some time to finish the guides.

from sigma.