sigma2sql 0.2.0__py3-none-any.whl

sigma2sql/detection.py

@@ -0,0 +1,230 @@
+"""Compile Sigma search identifiers (the maps and lists under `detection`) into Expr trees."""
+
+from __future__ import annotations
+
+import base64
+import ipaddress
+import itertools
+import re
+from typing import Any, Literal
+
+from sigma2sql.errors import RuleError, UnsupportedRule
+from sigma2sql.expr import (
+    Cidr,
+    Compare,
+    Exists,
+    Expr,
+    FieldRef,
+    NullMatch,
+    NumMatch,
+    Regex,
+    SigmaString,
+    StrMatch,
+    all_of,
+    any_of,
+)
+
+POSITION = {"contains", "startswith", "endswith"}
+COMPARE: dict[str, Literal["<", "<=", ">", ">="]] = {"lt": "<", "lte": "<=", "gt": ">", "gte": ">="}
+# Text encodings applied before base64; `utf16` adds the little-endian byte order mark.
+ENCODINGS = {"wide": "utf-16-le", "utf16le": "utf-16-le", "utf16be": "utf-16-be", "utf16": "utf-16"}
+BASE64 = {"base64", "base64offset"}
+KNOWN = (
+    POSITION
+    | set(COMPARE)
+    | set(ENCODINGS)
+    | BASE64
+    | {"all", "cased", "windash", "re", "i", "cidr", "exists", "fieldref"}
+)
+# Modifiers that make sense on keywords (searches over the whole event).
+KEYWORD_MODS = POSITION | set(ENCODINGS) | BASE64 | {"all", "cased", "windash", "re", "i"}
+
+# Characters Windows command-line tools accept in place of a leading dash.
+WINDASH = ("-", "/", "–", "—", "―")
+# A `-` or `/` that starts a word (same rule as pySigma).
+WINDASH_FLAG = re.compile(r"\B[-/]\b")
+MAX_WINDASH_FLAGS = 3
+
+
+def compile_search(name: str, value: Any) -> Expr:
+    if isinstance(value, dict):
+        return _compile_map(name, value)
+    if isinstance(value, list) and value:
+        if all(isinstance(v, dict) for v in value):
+            return any_of([_compile_map(name, v) for v in value])
+        if all(_is_scalar(v) for v in value):
+            return any_of([_keyword(name, v) for v in value])
+    if _is_scalar(value) and value is not None:
+        return _keyword(name, value)
+    raise RuleError(f"search {name!r} must be a map, a list of maps or a list of keywords")
+
+
+def _is_scalar(value: Any) -> bool:
+    return value is None or isinstance(value, str | int | float | bool)
+
+
+def _keyword(name: str, value: Any) -> Expr:
+    if value is None:
+        raise RuleError(f"search {name!r} has a null keyword")
+    # Keywords match anywhere in the event, so they behave like `contains`.
+    return StrMatch(None, SigmaString.parse(_as_text(value)).wrap(before=True, after=True))
+
+
+def _compile_map(name: str, mapping: dict[Any, Any]) -> Expr:
+    if not mapping:
+        raise RuleError(f"search {name!r} is an empty map")
+    return all_of([_compile_field(str(key), value) for key, value in mapping.items()])
+
+
+def _compile_field(key: str, value: Any) -> Expr:
+    name, *mods = key.split("|")
+    for mod in mods:
+        if mod not in KNOWN:
+            raise UnsupportedRule(f"modifier {mod!r} is not supported")
+    # `'|all': [a, b]` is a keyword search: no field, matched anywhere in the event.
+    field: str | None = name or None
+    label = name or "keywords"
+    if field is None:
+        extra = [m for m in mods if m not in KEYWORD_MODS]
+        if extra:
+            raise UnsupportedRule(f"modifier {extra[0]!r} is not supported on keywords")
+
+    values = value if isinstance(value, list) else [value]
+    if not values:
+        raise RuleError(f"field {label!r} has an empty value list")
+    for v in values:
+        if not _is_scalar(v):
+            raise RuleError(f"field {label!r} has a nested value")
+
+    items: list[Expr]
+    if field is None and "re" in mods:
+        items = [Regex(None, _as_text(v), ignore_case="i" in mods) for v in values]
+    elif field is None:
+        items = [
+            _strings(None, v, mods, "contains", "cased" in mods) for v in values if v is not None
+        ]
+        if len(items) != len(values):
+            raise RuleError("keywords cannot be null")
+    elif "exists" in mods:
+        if len(values) != 1 or not isinstance(values[0], bool):
+            raise RuleError(f"{field}|exists expects true or false")
+        return Exists(field, values[0])
+    elif "fieldref" in mods:
+        items = [FieldRef(field, _as_text(v)) for v in values]
+    elif "re" in mods:
+        items = [Regex(field, _as_text(v), ignore_case="i" in mods) for v in values]
+    elif "cidr" in mods:
+        items = [Cidr(field, _network(field, v)) for v in values]
+    elif compare := [m for m in mods if m in COMPARE]:
+        if len(compare) > 1:
+            raise RuleError(f"field {field!r} has more than one comparison modifier")
+        items = [Compare(field, COMPARE[compare[0]], _number(field, v)) for v in values]
+    else:
+        position = [m for m in mods if m in POSITION]
+        if len(position) > 1:
+            raise RuleError(f"field {field!r} has more than one of contains/startswith/endswith")
+        items = [
+            _value(field, v, mods, position[0] if position else None, "cased" in mods)
+            for v in values
+        ]
+
+    return all_of(items) if "all" in mods else any_of(items)
+
+
+def _value(field: str, value: Any, mods: list[str], position: str | None, cased: bool) -> Expr:
+    if value is None:
+        return NullMatch(field)
+    is_number = isinstance(value, int | float) and not isinstance(value, bool)
+    if is_number and not position and not (set(mods) & (BASE64 | {"windash"})):
+        return NumMatch(field, value)
+    return _strings(field, value, mods, position, cased)
+
+
+def _strings(
+    field: str | None, value: Any, mods: list[str], position: str | None, cased: bool
+) -> Expr:
+    """Match a string value after windash/encoding/base64 transformations."""
+    raw = _as_text(value)
+    encoding = [m for m in mods if m in ENCODINGS]
+    b64 = [m for m in mods if m in BASE64]
+    if len(encoding) > 1 or len(b64) > 1:
+        raise RuleError(f"{field or 'keywords'} has conflicting encoding modifiers")
+    if encoding and not b64:
+        raise UnsupportedRule(f"{encoding[0]} is only supported together with base64")
+
+    patterns: list[SigmaString]
+    if b64:
+        plain = SigmaString.parse(raw)
+        if plain.has_wildcards:
+            raise UnsupportedRule("base64 modifiers cannot encode wildcards")
+        data = _encode(plain.text, ENCODINGS[encoding[0]] if encoding else None)
+        encoded = [base64.b64encode(data).decode()] if b64[0] == "base64" else _offsets(data)
+        # Encoded text is literal and case-sensitive.
+        patterns = [SigmaString((e,)) for e in encoded]
+        cased = True
+    else:
+        variants = _windash(raw) if "windash" in mods else [raw]
+        patterns = [SigmaString.parse(v) for v in variants]
+
+    before = position in ("contains", "endswith")
+    after = position in ("contains", "startswith")
+    return any_of([StrMatch(field, p.wrap(before=before, after=after), cased) for p in patterns])
+
+
+def _encode(text: str, encoding: str | None) -> bytes:
+    if encoding == "utf-16":
+        return b"\xff\xfe" + text.encode("utf-16-le")
+    return text.encode(encoding or "utf-8")
+
+
+def _offsets(data: bytes) -> list[str]:
+    """The three base64 forms of `data` at byte offsets 0, 1 and 2 inside a longer blob,
+    trimmed to the characters that do not depend on the surrounding bytes."""
+    start = (0, 2, 3)
+    end = (None, -3, -2)
+    out = []
+    for i in range(3):
+        encoded = base64.b64encode(i * b" " + data).decode()
+        out.append(encoded[start[i] : end[(len(data) + i) % 3]])
+    return out
+
+
+def _windash(raw: str) -> list[str]:
+    """Every way of writing the value's command-line flags with each WINDASH character.
+
+    A flag is a `-` or `/` that starts a word, so ` /accepteula` also matches ` -accepteula`.
+    """
+    positions = [m.start() for m in WINDASH_FLAG.finditer(raw)]
+    if len(positions) > MAX_WINDASH_FLAGS:
+        # Too many combinations: use one dash style for all flags at once.
+        combos: list[tuple[str, ...]] = [(dash,) * len(positions) for dash in WINDASH]
+    else:
+        combos = list(itertools.product(WINDASH, repeat=len(positions)))
+    out: list[str] = []
+    for combo in combos:
+        chars = list(raw)
+        for pos, dash in zip(positions, combo, strict=True):
+            chars[pos] = dash
+        variant = "".join(chars)
+        if variant not in out:
+            out.append(variant)
+    return out
+
+
+def _as_text(value: Any) -> str:
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    return str(value)
+
+
+def _number(field: str, value: Any) -> int | float:
+    if isinstance(value, int | float) and not isinstance(value, bool):
+        return value
+    raise RuleError(f"field {field!r} needs a number for comparison, got {value!r}")
+
+
+def _network(field: str, value: Any) -> str:
+    try:
+        return str(ipaddress.ip_network(_as_text(value), strict=False))
+    except ValueError as exc:
+        raise RuleError(f"field {field!r} has an invalid CIDR {value!r}") from exc

sigma2sql/errors.py

@@ -0,0 +1,6 @@
+class RuleError(Exception):
+    """The rule is not valid Sigma."""
+
+
+class UnsupportedRule(Exception):
+    """The rule is valid Sigma but uses a feature sigma2sql cannot translate."""

sigma2sql/expr.py

@@ -0,0 +1,140 @@
+"""Dialect-independent match tree that detections compile into."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from enum import Enum
+from typing import Literal
+
+
+class Wildcard(Enum):
+    MANY = "*"
+    ONE = "?"
+
+
+Part = str | Wildcard
+
+
+@dataclass(frozen=True)
+class SigmaString:
+    parts: tuple[Part, ...]
+
+    @classmethod
+    def parse(cls, raw: str) -> SigmaString:
+        """Split a Sigma value into literals and wildcards.
+
+        `\\*`, `\\?` and `\\\\` are escapes; any other backslash is literal.
+        """
+        parts: list[Part] = []
+        buf: list[str] = []
+        i = 0
+        while i < len(raw):
+            ch = raw[i]
+            if ch == "\\" and i + 1 < len(raw) and raw[i + 1] in "*?\\":
+                buf.append(raw[i + 1])
+                i += 2
+                continue
+            if ch in "*?":
+                if buf:
+                    parts.append("".join(buf))
+                    buf = []
+                parts.append(Wildcard(ch))
+            else:
+                buf.append(ch)
+            i += 1
+        if buf:
+            parts.append("".join(buf))
+        return cls(tuple(parts))
+
+    def wrap(self, *, before: bool, after: bool) -> SigmaString:
+        parts = list(self.parts)
+        if before and parts[:1] != [Wildcard.MANY]:
+            parts.insert(0, Wildcard.MANY)
+        if after and parts[-1:] != [Wildcard.MANY]:
+            parts.append(Wildcard.MANY)
+        return SigmaString(tuple(parts))
+
+    @property
+    def has_wildcards(self) -> bool:
+        return any(isinstance(p, Wildcard) for p in self.parts)
+
+    @property
+    def text(self) -> str:
+        """Literal text; only meaningful when there are no wildcards."""
+        return "".join(p for p in self.parts if isinstance(p, str))
+
+
+@dataclass(frozen=True)
+class StrMatch:
+    field: str | None  # None means a keyword search over the whole event
+    value: SigmaString
+    cased: bool = False
+
+
+@dataclass(frozen=True)
+class NumMatch:
+    field: str
+    value: int | float
+
+
+@dataclass(frozen=True)
+class NullMatch:
+    field: str
+
+
+@dataclass(frozen=True)
+class Exists:
+    field: str
+    exists: bool
+
+
+@dataclass(frozen=True)
+class Regex:
+    field: str | None  # None means the whole event
+    pattern: str
+    ignore_case: bool = False
+
+
+@dataclass(frozen=True)
+class Cidr:
+    field: str
+    network: str
+
+
+@dataclass(frozen=True)
+class Compare:
+    field: str
+    op: Literal["<", "<=", ">", ">="]
+    value: int | float
+
+
+@dataclass(frozen=True)
+class FieldRef:
+    field: str
+    other: str
+
+
+@dataclass(frozen=True)
+class And:
+    items: tuple[Expr, ...]
+
+
+@dataclass(frozen=True)
+class Or:
+    items: tuple[Expr, ...]
+
+
+@dataclass(frozen=True)
+class Not:
+    item: Expr
+
+
+Expr = StrMatch | NumMatch | NullMatch | Exists | Regex | Cidr | Compare | FieldRef | And | Or | Not
+
+
+def all_of(items: list[Expr]) -> Expr:
+    return items[0] if len(items) == 1 else And(tuple(items))
+
+
+def any_of(items: list[Expr]) -> Expr:
+    return items[0] if len(items) == 1 else Or(tuple(items))

sigma2sql/hunt.py

@@ -0,0 +1,116 @@
+"""Run many rules over log files with DuckDB, no database server needed."""
+
+from __future__ import annotations
+
+import ipaddress
+from dataclasses import dataclass, field, replace
+from pathlib import Path
+from typing import Any
+
+from sigma2sql.collection import Collection
+from sigma2sql.correlation import correlation_query
+from sigma2sql.errors import RuleError, UnsupportedRule
+from sigma2sql.rule import Correlation, Document
+from sigma2sql.sql import Target, literal, to_query
+
+LEVELS = ("critical", "high", "medium", "low", "informational")
+TABLE = "events"
+COLUMN = "data"
+
+
+@dataclass
+class Hit:
+    rule: Document
+    count: int
+    examples: list[str] = field(default_factory=list)
+
+    @property
+    def rank(self) -> int:
+        return LEVELS.index(self.rule.level) if self.rule.level in LEVELS else len(LEVELS)
+
+
+@dataclass
+class Report:
+    events: int
+    hits: list[Hit]
+    ran: int
+    skipped: list[tuple[Document, str]]
+
+
+def connect() -> Any:
+    try:
+        import duckdb
+    except ImportError as exc:  # pragma: no cover - depends on the install
+        raise SystemExit("sigma2sql hunt needs DuckDB: pip install 'sigma2sql[duckdb]'") from exc
+    con = duckdb.connect()
+    con.create_function("cidr_match", _cidr_match, ["VARCHAR", "VARCHAR"], "BOOLEAN")
+    con.execute(f"CREATE TABLE {TABLE} ({COLUMN} JSON)")
+    return con
+
+
+def load_logs(con: Any, paths: list[str]) -> int:
+    """Load JSON/JSON Lines, Parquet or CSV files (globs allowed) as one JSON object per row."""
+    for path in paths:
+        source = literal(path)
+        suffix = Path(path).suffix.lower()
+        if suffix == ".parquet":
+            select = f"SELECT to_json(t) FROM read_parquet({source}) t"
+        elif suffix in (".csv", ".tsv"):
+            select = f"SELECT to_json(t) FROM read_csv_auto({source}) t"
+        elif suffix in (".json", ".jsonl", ".ndjson"):
+            select = f"SELECT json FROM read_json_objects({source}, format = 'auto')"
+        else:
+            raise ValueError(f"{path}: expected .json, .jsonl, .ndjson, .parquet or .csv")
+        con.execute(f"INSERT INTO {TABLE} {select}")
+    count: int = con.execute(f"SELECT COUNT(*) FROM {TABLE}").fetchone()[0]
+    return count
+
+
+def hunt(
+    rules: Collection, paths: list[str], base: Target | None = None, examples: int = 0
+) -> Report:
+    """Run every rule and correlation in `rules` over the logs in `paths`.
+
+    `base` carries the field mapping and timestamp settings; table and dialect are set here.
+    """
+    con = connect()
+    events = load_logs(con, paths)
+    base = base or Target()
+    # All logs share one table here, so profile routes keep only their conditions.
+    routes = tuple(replace(r, table=None) for r in base.routes)
+    target = replace(base, dialect="duckdb", table=TABLE, json_column=COLUMN, routes=routes)
+    items: list[Document] = [*rules.standalone(), *rules.correlations]
+    hits: list[Hit] = []
+    skipped: list[tuple[Document, str]] = []
+    for item in items:
+        try:
+            query, as_rows = _query(item, rules, target)
+        except (RuleError, UnsupportedRule) as exc:
+            skipped.append((item, str(exc)))
+            continue
+        count = con.execute(f"SELECT COUNT(*) FROM ({query}) q").fetchone()[0]
+        if not count:
+            continue
+        sample: list[str] = []
+        if examples:
+            shown = f"SELECT CAST(to_json(q) AS VARCHAR) FROM ({query}) q" if as_rows else query
+            sample = [row[0] for row in con.execute(f"{shown} LIMIT {examples}").fetchall()]
+        hits.append(Hit(item, count, sample))
+    hits.sort(key=lambda h: (h.rank, -h.count, h.rule.title))
+    return Report(events, hits, len(items) - len(skipped), skipped)
+
+
+def _query(item: Document, rules: Collection, target: Target) -> tuple[str, bool]:
+    """The SQL for one item and whether it returns result rows rather than events."""
+    if isinstance(item, Correlation):
+        return correlation_query(item, rules.resolve(item), target), True
+    if item.aggregation is not None:
+        return to_query(item, target), True
+    return to_query(item, target, columns=f"CAST({COLUMN} AS VARCHAR)"), False
+
+
+def _cidr_match(value: str, network: str) -> bool:
+    try:
+        return ipaddress.ip_address(value) in ipaddress.ip_network(network)
+    except ValueError:
+        return False

sigma2sql/profile.py

@@ -0,0 +1,119 @@
+"""Profiles: reusable field mappings, logsource routing and timestamp settings.
+
+A profile is a YAML file:
+
+    description: one line shown by `sigma2sql profiles`
+    json_column: data            # optional
+    nested: true                 # dotted names are paths into nested JSON
+    timestamp: "@timestamp"
+    timestamp_format: iso        # iso, epoch_s or epoch_ms
+    default_field: "winlog.event_data.{field}"
+    fields:
+      Image: process.executable
+      EventID: [Event.System.EventID.#text, Event.System.EventID]   # first present wins
+    logsources:
+      - match: {product: windows, category: process_creation}
+        table: process_events    # optional
+        where: {event.code: "1"} # optional, in target field names
+
+Built-in profiles ship in `sigma2sql/profiles/`; pass a name or a path.
+"""
+
+from __future__ import annotations
+
+from dataclasses import replace
+from importlib import resources
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from sigma2sql.sql import Route, Target
+
+KEYS = {
+    "description",
+    "json_column",
+    "nested",
+    "timestamp",
+    "timestamp_format",
+    "default_field",
+    "fields",
+    "logsources",
+}
+
+
+def builtin_profiles() -> dict[str, str]:
+    """Name -> description of the profiles that ship with sigma2sql."""
+    out: dict[str, str] = {}
+    for entry in sorted(resources.files("sigma2sql.profiles").iterdir(), key=lambda e: e.name):
+        if entry.name.endswith(".yml"):
+            data = yaml.safe_load(entry.read_text(encoding="utf-8")) or {}
+            out[entry.name.removesuffix(".yml")] = str(data.get("description", ""))
+    return out
+
+
+def load_profile(name_or_path: str) -> dict[str, Any]:
+    path = Path(name_or_path)
+    if path.suffix in (".yml", ".yaml") or path.exists():
+        text = path.read_text(encoding="utf-8")
+    else:
+        entry = resources.files("sigma2sql.profiles").joinpath(f"{name_or_path}.yml")
+        if not entry.is_file():
+            known = ", ".join(builtin_profiles())
+            raise ValueError(f"unknown profile {name_or_path!r} (built in: {known})")
+        text = entry.read_text(encoding="utf-8")
+    data = yaml.safe_load(text) or {}
+    if not isinstance(data, dict):
+        raise ValueError("a profile must be a YAML map")
+    unknown = set(data) - KEYS
+    if unknown:
+        raise ValueError(f"unknown profile keys: {', '.join(sorted(unknown))}")
+    return data
+
+
+def apply_profile(target: Target, profile: dict[str, Any]) -> Target:
+    """Target with the profile's settings; fields already in `target.mapping` win."""
+    fields = profile.get("fields") or {}
+    if not isinstance(fields, dict):
+        raise ValueError("profile 'fields' must be a map")
+    routes: list[Route] = []
+    for item in profile.get("logsources") or []:
+        if not isinstance(item, dict) or not isinstance(item.get("match"), dict):
+            raise ValueError("each profile logsource needs a 'match' map")
+        where = item.get("where")
+        if where is not None and not isinstance(where, dict):
+            raise ValueError("profile logsource 'where' must be a map")
+        routes.append(
+            Route(
+                match={str(k): str(v) for k, v in item["match"].items()},
+                table=item.get("table"),
+                where=where,
+            )
+        )
+    template = profile.get("default_field")
+    templates = None
+    if template is not None:
+        templates = tuple(template) if isinstance(template, list) else (str(template),)
+        if not all("{field" in t for t in templates):
+            raise ValueError("profile 'default_field' must contain {field} or {field_words}")
+    fmt = profile.get("timestamp_format", target.timestamp_format)
+    if fmt not in ("iso", "epoch_s", "epoch_ms"):
+        raise ValueError(f"invalid timestamp_format {fmt!r}")
+    return replace(
+        target,
+        mapping={**{str(k): _target_field(v) for k, v in fields.items()}, **target.mapping},
+        json_column=profile.get("json_column", target.json_column),
+        nested=bool(profile.get("nested", target.nested)),
+        timestamp=str(profile.get("timestamp", target.timestamp)),
+        timestamp_format=fmt,
+        default_field=templates if templates is not None else target.default_field,
+        routes=(*target.routes, *routes),
+    )
+
+
+def _target_field(value: Any) -> str | tuple[str, ...]:
+    if isinstance(value, list):
+        if not value or not all(isinstance(v, str) for v in value):
+            raise ValueError("a profile field list must hold field names")
+        return tuple(value)
+    return str(value)

sigma2sql/profiles/ecs-winlogbeat.yml

@@ -0,0 +1,43 @@
+description: Windows events shipped by Winlogbeat in Elastic Common Schema (nested JSON); unmapped fields fall back to winlog.event_data
+nested: true
+timestamp: "@timestamp"
+default_field: "winlog.event_data.{field}"
+fields:
+  EventID: event.code
+  Channel: winlog.channel
+  Provider_Name: winlog.provider_name
+  Computer: host.name
+  Image: process.executable
+  CommandLine: process.command_line
+  ProcessId: process.pid
+  CurrentDirectory: process.working_directory
+  OriginalFileName: process.pe.original_file_name
+  Product: process.pe.product
+  Company: process.pe.company
+  Description: process.pe.description
+  ParentImage: process.parent.executable
+  ParentCommandLine: process.parent.command_line
+  ParentProcessId: process.parent.pid
+  User: user.name
+  TargetFilename: file.path
+  ImageLoaded: file.path
+  DestinationIp: destination.ip
+  DestinationPort: destination.port
+  DestinationHostname: destination.domain
+  SourceIp: source.ip
+  SourcePort: source.port
+  QueryName: dns.question.name
+  TargetObject: registry.path
+logsources:
+  # Sysmon via the Winlogbeat sysmon module: event.code holds the event ID as a string.
+  - {match: {product: windows, category: process_creation}, where: {winlog.channel: Microsoft-Windows-Sysmon/Operational, event.code: "1"}}
+  - {match: {product: windows, category: network_connection}, where: {winlog.channel: Microsoft-Windows-Sysmon/Operational, event.code: "3"}}
+  - {match: {product: windows, category: image_load}, where: {winlog.channel: Microsoft-Windows-Sysmon/Operational, event.code: "7"}}
+  - {match: {product: windows, category: process_access}, where: {winlog.channel: Microsoft-Windows-Sysmon/Operational, event.code: "10"}}
+  - {match: {product: windows, category: file_event}, where: {winlog.channel: Microsoft-Windows-Sysmon/Operational, event.code: "11"}}
+  - {match: {product: windows, category: registry_set}, where: {winlog.channel: Microsoft-Windows-Sysmon/Operational, event.code: "13"}}
+  - {match: {product: windows, category: registry_event}, where: {winlog.channel: Microsoft-Windows-Sysmon/Operational, event.code: ["12", "13", "14"]}}
+  - {match: {product: windows, category: dns_query}, where: {winlog.channel: Microsoft-Windows-Sysmon/Operational, event.code: "22"}}
+  - {match: {product: windows, service: security}, where: {winlog.channel: Security}}
+  - {match: {product: windows, service: system}, where: {winlog.channel: System}}
+  - {match: {product: windows, service: powershell}, where: {winlog.channel: Microsoft-Windows-PowerShell/Operational}}