Manage placeholders Rule

[frack113]

From #3364
the rules can not have universal field value. It must be modified and adapted before being used.
I have template because I did not find a better name.

We can create a rule-template folder, for the PR it give rules-template/cloud/azure/

For the field value it can be :

• Time: '<outside normal working hours , eg 20h00-08h00>'
• Time: '20h00-08h00' #outside normal working hours

Add a genreic warning like

# This is a template. rule You have to tune it to fit your environnement before use it
detection:
    selection:
...

[wagga40]

Why not use a special formatting for the field value, and prevent conversion by backend if it is not customized ?

If we use something like below, Jinja can be used to automate rules production :
Time: {{time _between_X_and_Y}} # '20h00-08h00'

[frack113]

So it is a Placeholder rule (I didn't like my term template)
The Placeholder rules need tuning so why not a rules-placeholder folder ?
No need to add a warning , if you use this directory you must know what you are doing.

Field value will be "%name%"
exemple:

    selection:
        Status: Sucess
        Location: %countries%
        Date: %working_hours%
    condition: selection

[Neo23x0]

Yes, as long as we put them in a separate folder, I'm fine with it.
I should add a section to the READM that explains the different folders and their contents.

[thomaspatzke]

I'm against separation into a separate folder for the following reasons:

• Conversion (with pySigma/sigma-cli) already fails or skips such rules if placeholders are not defined. Therefore the user gets aware about this.
• Rules with placeholders are nothing new and are already present in the main rule set (example). Consequently, these should be moved, too.
• I think in the future placeholders (now as they are finally properly supported at least by pySigma) could get a good practice in rules. I believe it would be much more convenient and safe to use rules if the user defines clients, servers and domain controllers once in a conversion configuration because such rules will directly use these, while rules that only mention this in the falsepositive attribute need manual changes to the rule or generated query itself. Placeholders are a great way to make such stuff manageable and separating rules using placeholders will put them in some kind of dark corner of this repository and thwart the adoption of this feature.
• Splitting off rules that use particular features will make the repository unclear in the long run. In the addition to the topics of the rule (windows, network, ...) we add another layers. This is just confusing for the users.

[Neo23x0]

Under understand your opinion, but I disagree on some points.

Conversion (with pySigma/sigma-cli) already fails or skips such rules if placeholders are not defined.

Sigma rules are used by more than sigmac or pySigma. We've seen many other projects / frameworks that use Sigma without using sigmac or pySigma.

Rules with placeholders are nothing new and are already present in the main rule set (example). Consequently, these should be moved, too.

yes

I think in the future placeholders (now as they are finally properly supported at least by pySigma) could get a good practice in rules.

I think it's wishful thinking that users like or even think about adding creating lists to populate placeholders. Only a minority will do this. 1-5% max. This is btw also the reason why e.g. people still use SwiftOnSecurity's Sysmon config instead of a modular Sysmon config like the one provided by Olaf Hartong.

I admit that rules using placeholders are already in the repository and would already cause problems with converters / tools / frameworks other than sigmac / pySigma. So these other converters / tools / frameworks must already use some way to avoid issues with unpopulated placeholders OR - and I think that's much more likely the case - just use the placeholder value as a plain text string in a query that will never produce any matches.

And this is also the reason why I would vote for a new folder, because people simply don't know that these rules contain placeholder values and thus don't try to figure out how to populate these values. If all placeholder rules would appear in a dedicated folder, users would notice them and think "aah, there are rules that use placeholders. How can I use these?"

put them in some kind of dark corner of this repository

It wouldn't be a dark corner, rather the opposite.
It would pull them into the light and generate the required attention.
Currently, mixed with all the other rules, they're in a dark corner and no one notices them.

[thomaspatzke]

Ok, I'm convinced, as usual I underestimate the usability aspect 😉 Let's do it this way! 👍