Added field comparison

SigmaHQ · Apr 20, 2023 · 1b55adb · 1b55adb
1 parent 6243be1
commit 1b55adb
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/...ckends/{{ cookiecutter.backend_package_name }}/{{ cookiecutter.backend_package_name }}.py b/...ckends/{{ cookiecutter.backend_package_name }}/{{ cookiecutter.backend_package_name }}.py
@@ -101,6 +101,10 @@ class {{ cookiecutter.backend_class_name }}(TextQueryBackend):
         SigmaCompareExpression.CompareOperators.GTE : ">=",
     }
 
+    # Expression for comparing two event fields
+    field_equals_field_expression : ClassVar[Optional[str]] = None  # Field comparison expression with the placeholders {field1} and {field2} corresponding to left field and right value side of Sigma detection item
+    field_equals_field_escaping_quoting : Tuple[bool, bool] = (True, True)   # If regular field-escaping/quoting is applied to field1 and field2. A custom escaping/quoting can be implemented in the convert_condition_field_eq_field_escape_and_quote method.
+
     # Null/None expressions
     field_null_expression : ClassVar[str] = "{field} is null"          # Expression for field has null value as format string with {field} placeholder for field name