Is your feature request related to a problem?
I have not checked all, but many of the sigma rules in opensearch 2.10 are quite old. The screenshot below is dated 2019 - but that rule in sigmahq repo was updated last month.
What solution would you like?
It would be nice to have a mechanism to update the rules periodically pulling from the repo. Alternatively, it would be good to re-baseline the rules for future releases to use a more recent pull from sigmahq. Not sure if pulling for each release is practical - but atleast 4x a year would keep them more current/relevant.
It would also be nice in the rule listing page in the GUI to have a column that show the date the the rule was last updated. Right now you would have to click on each rule individually to see the meta info (reference the screenshot below)
What alternatives have you considered?
The alternative would be to pull the repo and use API calls to put fresh rules into our index periodically. We would need to try to match and overwrite rules with newer versions, and import newer rules.
Do you have any additional context?
Is your feature request related to a problem?
I have not checked all, but many of the sigma rules in opensearch 2.10 are quite old. The screenshot below is dated 2019 - but that rule in sigmahq repo was updated last month.
What solution would you like?
It would be nice to have a mechanism to update the rules periodically pulling from the repo. Alternatively, it would be good to re-baseline the rules for future releases to use a more recent pull from sigmahq. Not sure if pulling for each release is practical - but atleast 4x a year would keep them more current/relevant.
It would also be nice in the rule listing page in the GUI to have a column that show the date the the rule was last updated. Right now you would have to click on each rule individually to see the meta info (reference the screenshot below)
What alternatives have you considered?
The alternative would be to pull the repo and use API calls to put fresh rules into our index periodically. We would need to try to match and overwrite rules with newer versions, and import newer rules.
Do you have any additional context?
