Skip to content

Commit

Permalink
added %RuleID% to Readme #794
Browse files Browse the repository at this point in the history
  • Loading branch information
hitenkoku committed Nov 6, 2022
1 parent 6a058d8 commit 7d22d41
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 0 deletions.
1 change: 1 addition & 0 deletions README-Japanese.md
Original file line number Diff line number Diff line change
Expand Up @@ -696,6 +696,7 @@ Hayabusaの`config/profiles.yaml`設定ファイルでは、5つのプロフ
|%RuleCreationDate% | YML検知ルールの `date` フィールド。 |
|%RuleModifiedDate% | YML検知ルールの `modified` フィールド。 |
|%Status% | YML検知ルールの `status` フィールド。 |
|%RuleID% | YML検知ルールの `id` フィールド。 |

これらのエイリアスは、出力プロファイルで使用することができます。また、他の[イベントキーアライズ](https://github.com/Yamato-Security/hayabusa-rules/blob/main/README-Japanese.md#%E3%82%A4%E3%83%99%E3%83%B3%E3%83%88%E3%82%AD%E3%83%BC%E3%82%A8%E3%82%A4%E3%83%AA%E3%82%A2%E3%82%B9)を定義し、他のフィールドを出力することもできます。

Expand Down
1 change: 1 addition & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -692,6 +692,7 @@ The following benchmarks were conducted on a 2018 MBP with 7.5GB of evtx data.
|%RuleCreationDate% | The `date` field in the YML detection rule. |
|%RuleModifiedDate% | The `modified` field in the YML detection rule. |
|%Status% | The `status` field in the YML detection rule. |
|%RuleID% | The `id` field in the YML detection rule. |

You can use these aliases in your output profiles, as well as define other [event key alises](https://github.com/Yamato-Security/hayabusa-rules/blob/main/README.md#eventkey-aliases) to output other fields.

Expand Down

0 comments on commit 7d22d41

Please sign in to comment.