Skip to content

multichoicea.md

Latest commit

 

History

History
30 lines (21 loc) · 834 Bytes

multichoicea.md

File metadata and controls

30 lines (21 loc) · 834 Bytes
Raw

multiChoiceA

Schema ID: https://git.bsk/thorx/lib/features/truncate/testobject/multi-choice-object-a | JSON Schema: https://json-schema.org/draft/2020-12/schema | Definition: MultiChoiceObjectA

Fields

Field names are shown in UPPERCASE as used in Sigma rules. The lowercase JSON name is shown in parentheses for reference.

Sigma Field JSON Name Type Required Description Example Values
FIELDA FieldA string ✅
TYPE type string ✅

No nested fields in this type.

Sigma Rule Template

logsource:
    product: THOR
    service: "multiChoiceA"

detection:
    selection:
        FIELDA|contains: 'suspicious_string'
    condition: selection

level: medium