Add new status "deprecated" for obsoletes rules

[frack113]

while discussing with my colleague about the rules of deprecated, he got the idea of a new depecied status.
It allows an easier management of the rules to be taken.

Maybe add the "not status" filter too.

[V1D1AN]

For me, it's a good idea

[Neo23x0]

What does "depecied" mean? I haven't heard that word before.

[frack113]

It is for the rule in "rules-unsupported" or "deprecated" .
example

$ grep -re "65531a81-a694-4e31-ae04-f8ba5bc33759"
deprecated/powershell_suspicious_download.yml:id: 65531a81-a694-4e31-ae04-f8ba5bc33759
powershell/powershell_classic/powershell_classic_suspicious_download.yml:    - id: 65531a81-a694-4e31-ae04-f8ba5bc33759
powershell/powershell_module/powershell_suspicious_download_in_contextinfo.yml:    - id: 65531a81-a694-4e31-ae04-f8ba5bc33759
powershell/powershell_script/powershell_suspicious_download_in_scriptblocktext.yml:    - id: 65531a81-a694-4e31-ae04-f8ba5bc33759

powershell_suspicious_download.yml get a status deprecated as the rule is not remove.
This rule can be use but without guarantee of operation.

Can be use for legacy os rule as can not guarantee works on supported os.

Term can be outdated

[Neo23x0]

I'd add deprecated and unsupported.

We'd have to update the Wiki. https://github.com/SigmaHQ/sigma/wiki/Specification#status-optional

The converter would then some day simply skip the rules with that status.
However, what we cannot do is move the unsupported rules into the ./rules folder. Some people that still use an older version of the converter would simply convert all rules in the folder.

[frack113]

I have to make some test :

• unsupported rules move to rules-unsupported directory perhaps create same sub directory as rule.
• deprecated rules get a the new status but keep it in the original folder (remove windows/deprecated)
• filter can exclude a status =! (fast way) or to be like the level filter 0 unsupported to 4 stable

[frack113]

For the wiki:

Declares the status of the rule:

• stable: the rule is considered as stable and may be used in production systems or dashboards.
• test: an almost stable rule that possibly could require some fine tuning.
• experimental: an experimental rule that could lead to false results or be noisy, but could also identify interesting events.
• deprecated: the rule is replace or cover by another one. link is made by the related id field.
• unsupported: the rule can not be use in its current state (special correlation log, home-made fields)

A notice or a spelling correction ?

[nasbench]

Resolved