Repository: google/timesketch

Issue:
Sigma tags as labels / tags for events
Sigma rules do come with something like:

```
tags:
    - attack.initial_access
    - attack.t1190
   ```

It could be useful to apply those tags to events that are found with the Sigma analyzer that does tag / label events. Instead (or in addition) of just the filename, the tags from the Sigma rule could be applied.


Discussion:

Resolving patch:
diff --git a/timesketch/lib/analyzers/sigma_tagger.py b/timesketch/lib/analyzers/sigma_tagger.py
--- a/timesketch/lib/analyzers/sigma_tagger.py
+++ b/timesketch/lib/analyzers/sigma_tagger.py
@@ -22,12 +22,13 @@ class SigmaPlugin(interface.BaseAnalyzer):
     DISPLAY_NAME = 'Sigma'
     DESCRIPTION = 'Run pre-defined Sigma rules and tag matching events'
 
-    def run_sigma_rule(self, query, tag_name):
+    def run_sigma_rule(self, query, rule_name, tag_list = None):
         """Runs a sigma rule and applies the appropriate tags.
 
         Args:
             query: elastic search query for events to tag.
-            tag_name: tag to apply to matching events.
+            rule_name: rule_name to apply to matching events.
+            tag_list: a list of additional tags to be added to the event(s)
 
         Returns:
             int: number of events tagged.
@@ -37,7 +38,8 @@ def run_sigma_rule(self, query, tag_name):
         events = self.event_stream(
             query_string=query, return_fields=return_fields)
         for event in events:
-            event.add_tags(['sigma_{0:s}'.format(tag_name)])
+            event.add_tags(['sigma_{0:s}'.format(rule_name)])
+            event.add_tags(tag_list)
             event.commit()
             tagged_events_counter += 1
         return tagged_events_counter
@@ -64,7 +66,8 @@ def run(self):
             try:
                 sigma_rule_counter += 1
                 tagged_events_counter = self.run_sigma_rule(
-                    rule.get('es_query'), rule.get('file_name'))
+                    rule.get('es_query'), rule.get('file_name'),
+                    tag_list=rule.get('tags'))
                 tags_applied[rule.get('file_name')] += tagged_events_counter
             except elasticsearch.TransportError as e:
                 logger.error(


Test patch:
diff --git a/timesketch/api/v1/resources_test.py b/timesketch/api/v1/resources_test.py
--- a/timesketch/api/v1/resources_test.py
+++ b/timesketch/api/v1/resources_test.py
@@ -416,6 +416,7 @@ class SigmaListResourceTest(BaseTest):
                 'service': 'shell'
             },
             'modified': '2020/06/26',
+            'tags': ['attack.discovery', 'attack.t1046'],
             'references': [
                 'https://rmusser.net/docs/ATT&CK-Stuff/ATT&CK/Discovery.html'
             ],
@@ -442,6 +443,9 @@ class SigmaByTextResourceTest(BaseTest):
         author: Alexander Jaeger
         date: 2020/12/10
         modified: 2020/12/10
+        tags:
+            - attack.discovery
+            - attack.t1046
         logsource:
             product: linux
             service: shell
@@ -467,6 +471,7 @@ class SigmaByTextResourceTest(BaseTest):
                 'author': 'Alexander Jaeger',
                 'date': '2020/12/10',
                 'modified': '2020/12/10',
+                'tags': ['attack.discovery', 'attack.t1046'],
                 'logsource': {
                     'product': 'linux',
                     'service': 'shell'