Andurin

Dynamically add Data Needed to Customer by DR

1

I like the dynamic way how a detection rule is able to declare the data needed part. This change will extend the list of DN for a customer depending on...

Transform current output formats to postprocessing

2

The pySigma (>=0.10.0) [post-processing](https://medium.com/sigma-hq/introducing-query-post-processing-and-output-finalization-to-processing-pipelines-4bfe74087ac1) feature allows a much more dynamic way to create different output formats. ES Backend should be rewritten including the current output formats as templates.

Bug: Performance issues caused by potential missing index in attributes table

2

### Actual behavior We have a table size for attributes around 75GB and with this huge amount of data we see different performance issues right now. For example waiting for...

Hi, while mapping Windows Event ID 7045 I'm missing some fields in Class Application Lifecycle (6002). For example: * actor (reference) (who did the action) * device (reference) (where happens...