Field Modifier yang Didukung¶
Halaman ini berisi daftar yang dihasilkan secara dinamis dari semua field modifier Sigma dan seberapa sering digunakan dalam aturan Sigma dan Hayabusa.
Field modifier yang didukung Hayabusa¶
| Field Modifier | Sigma Count | Hayabusa Count |
|---|---|---|
| all | 13 | 0 |
| base64offsetǀcontains | 7 | 0 |
| base64ǀcontains | 1 | 0 |
| cased | 0 | 0 |
| cidr | 36 | 0 |
| contains | 3119 | 23 |
| containsǀall | 1094 | 8 |
| containsǀcased | 0 | 0 |
| containsǀexpand | 3 | 0 |
| containsǀwindash | 111 | 0 |
| endswith | 3307 | 283 |
| endswithfield | 0 | 0 |
| endswithǀcased | 0 | 0 |
| endswithǀwindash | 2 | 0 |
| equalsfield | 0 | 0 |
| exists | 0 | 0 |
| expand | 20 | 0 |
| fieldref | 4 | 1 |
| fieldrefǀcontains | 0 | 0 |
| fieldrefǀendswith | 0 | 2 |
| fieldrefǀstartswith | 0 | 0 |
| gt | 0 | 0 |
| gte | 0 | 0 |
| lt | 0 | 0 |
| lte | 0 | 0 |
| re | 189 | 11 |
| reǀi | 4 | 0 |
| reǀm | 0 | 0 |
| reǀs | 0 | 0 |
| startswith | 560 | 6 |
| startswithǀcased | 0 | 0 |
| utf16beǀbase64offsetǀcontains | 0 | 0 |
| utf16leǀbase64offsetǀcontains | 0 | 0 |
| utf16ǀbase64offsetǀcontains | 0 | 0 |
| wideǀbase64offsetǀcontains | 2 | 0 |
Field modifier yang tidak didukung Hayabusa¶
Saat ini, semuanya didukung.
Aturan korelasi yang didukung Hayabusa¶
| Correlation Rule | Sigma Count | Hayabusa Count |
|---|---|---|
| event_count | 0 | 0 |
| event_count (with group-by) | 0 | 1 |
| temporal | 0 | 0 |
| temporal (with group-by) | 0 | 0 |
| temporal_ordered | 0 | 0 |
| temporal_ordered (with group-by) | 0 | 0 |
| value_count | 0 | 0 |
| value_count (with group-by) | 0 | 2 |
Aturan korelasi yang tidak didukung Hayabusa¶
Saat ini, semuanya didukung.
Dokumen ini diperbarui secara dinamis setiap bulan berdasarkan aturan terbaru.
Pembaruan Terakhir: 2026/11/01