Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fieldref support #137

Merged
merged 9 commits into from
Apr 15, 2024
Merged

Fieldref support #137

merged 9 commits into from
Apr 15, 2024

Conversation

jamesc-grafana
Copy link
Collaborator

Adds in support for fieldref modifiers as part of pySigma to enable reference to other fields in the log line

@jamesc-grafana jamesc-grafana added the backend Related to changes to the query backend label Apr 9, 2024
@jamesc-grafana jamesc-grafana self-assigned this Apr 9, 2024
@jamesc-grafana jamesc-grafana requested a review from a team as a code owner April 9, 2024 10:13
@coveralls
Copy link

coveralls commented Apr 9, 2024 •
edited

Pull Request Test Coverage Report for Build 8660522583

Details

  • 41 of 42 (97.62%) changed or added relevant lines in 1 file are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage decreased (-0.1%) to 99.023%
Changes Missing Coverage Covered Lines Changed/Added Lines %
sigma/backends/loki/loki.py 41 42 97.62%
Totals Coverage Status
Change from base Build 8252457078: -0.1%
Covered Lines: 507
Relevant Lines: 512
💛 - Coveralls

kelnage
kelnage requested changes Apr 9, 2024
View reviewed changes
Copy link
Collaborator

@kelnage kelnage left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice implementation, but I noticed a couple of issues that could be problematic in edge cases :)

sigma/backends/loki/loki.py Outdated Show resolved Hide resolved
sigma/backends/loki/loki.py Outdated Show resolved Hide resolved
sigma/backends/loki/loki.py Show resolved Hide resolved
@kelnage kelnage linked an issue Apr 11, 2024 that may be closed by this pull request
Add support for fieldref modifier #136
Closed
kelnage
kelnage requested changes Apr 12, 2024
View reviewed changes
Copy link
Collaborator

@kelnage kelnage left a comment •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Really minor bits of me being opinionated about Python (sorry! Feel free to push back) and a minor documentation issue - but this is otherwise a really great implementation 👍 Love the extra tests for the pipelines 🥳

sigma/backends/loki/loki.py Outdated Show resolved Hide resolved
sigma/backends/loki/loki.py Outdated Show resolved Hide resolved
sigma/backends/loki/loki.py Outdated Show resolved Hide resolved
sigma/backends/loki/loki.py Show resolved Hide resolved
kelnage
kelnage approved these changes Apr 12, 2024
View reviewed changes
Copy link
Collaborator

@kelnage kelnage left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@jamesc-grafana jamesc-grafana merged commit 032af6f into main Apr 15, 2024
13 checks passed
@kelnage kelnage deleted the fieldref-support branch April 15, 2024 09:53
@kelnage kelnage mentioned this pull request Apr 19, 2024
Merged
@jamesc-grafana jamesc-grafana mentioned this pull request Apr 25, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kelnage kelnage kelnage approved these changes

Assignees

@jamesc-grafana jamesc-grafana

Labels
backend Related to changes to the query backend
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Add support for fieldref modifier
3 participants
@jamesc-grafana @coveralls @kelnage