Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update diagrams #914

Merged
merged 4 commits into from
Sep 30, 2024
Merged

Update diagrams #914

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a0d9390
Update diagrams
predictiple Sep 20, 2024
fb4645e
Embed SVG fonts
predictiple Sep 20, 2024
2851f0e
Change to inline SVGs
predictiple Sep 21, 2024
cf81b59
Revert "Change to inline SVGs"
scudette Sep 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion content/blog/2023/2023-11-15-sigma_in_velociraptor/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,7 +212,7 @@ only matching events are forwarded to the server. This minimizes the
total amount of data that needs to be managed by the server to only
high value, relevant events that already match the Sigma rules.

![Velociraptor Sigma Workflow](velociraptor_sigma_flow.png)
![Velociraptor Sigma Workflow](velociraptor_sigma_flow.svg)

The above figure outlines the Velociraptor Sigma workflow:

Expand Down
Binary file removed content/blog/2023/2023-11-15-sigma_in_velociraptor/velociraptor_sigma_flow.png
View file
Open in desktop
Binary file not shown.
20 changes: 20 additions & 0 deletions content/blog/2023/2023-11-15-sigma_in_velociraptor/velociraptor_sigma_flow.svg
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
6 changes: 3 additions & 3 deletions content/blog/2024/2024-05-09-detection-engineering/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ the basic principals are similar (collect logs, normalize logs into a
schema, forward to data mining system and then query the data) the
specifics are very different.

![](edr_env.png)
![](edr_env.svg)

## The Sigma Rule format

Expand All @@ -90,7 +90,7 @@ detection rules. These rules are then fed to specialized `Sigma
Compilers` to produce stack specific queries for difference SIEM
vendors.

![](sigma_architecture.png)
![](sigma_architecture.svg)

Sigma addresses the differences between the detection stacks by
introducing abstractions at various levels:
Expand Down Expand Up @@ -457,7 +457,7 @@ sections:
event log files.
3. A mapping between Sigma rules and their corresponding event fields.

![Velociraptor Sigma Workflow](velociraptor_sigma_flow.png)
![Velociraptor Sigma Workflow](velociraptor_sigma_flow.svg)


## Velociraptor curated rules
Expand Down
Loading
Loading