Skip to content

environment-variable.md

Latest commit

 

History

History
31 lines (22 loc) · 894 Bytes

environment-variable.md

File metadata and controls

31 lines (22 loc) · 894 Bytes
Raw

environment variable

Schema ID: https://github.com/NextronSystems/jsonlog/thorlog/v3/environment-variable | JSON Schema: https://json-schema.org/draft/2020-12/schema | Definition: EnvironmentVariable

Fields

Field names are shown in UPPERCASE as used in Sigma rules. The lowercase JSON name is shown in parentheses for reference.

Sigma Field JSON Name Type Required Description Example Values
TYPE type string ✅
VALUE value string ✅
VARIABLE variable string ✅

No nested fields in this type.

Sigma Rule Template

logsource:
    product: THOR
    service: "environment variable"

detection:
    selection:
        VALUE|contains: 'suspicious_string'
    condition: selection

level: medium