You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
Currently, the elastic_ecs connector does not support case insensitive flag like /abc/i or /(?i)abc/, and hunters need to write command_line MATCHES '([Vv][Ii][Rr][Uu][Ss])'.
Describe the solution you'd like
From syntax, we expect users to write command_line MATCHES '(?i)virus'. After checking more into Elasticsearch docs, we found the most feasible solution to do it in stix-shifter is to unfold (?i) in translation and keep the transmission as current implementation.
The text was updated successfully, but these errors were encountered:
subbyte
added a commit
to subbyte/stix-shifter
that referenced
this issue
Sep 5, 2023
Is your feature request related to a problem? Please describe.
Currently, the elastic_ecs connector does not support case insensitive flag like
/abc/i
or/(?i)abc/
, and hunters need to writecommand_line MATCHES '([Vv][Ii][Rr][Uu][Ss])'
.Describe the solution you'd like
From syntax, we expect users to write
command_line MATCHES '(?i)virus'
. After checking more into Elasticsearch docs, we found the most feasible solution to do it in stix-shifter is to unfold(?i)
in translation and keep the transmission as current implementation.The text was updated successfully, but these errors were encountered: