Added plugin metadata to/for pipelines

SigmaHQ · Feb 11, 2023 · bc75b98 · bc75b98
1 parent d3dd3e8
commit bc75b98
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 2 deletions.
diff --git a/pyproject.toml b/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "pysigma-backend-splunk"
-version = "1.0.1"
+version = "1.0.2"
 description = "pySigma Splunk backend"
 authors = ["Thomas Patzke <thomas@patzke.org>"]
 license = "LGPL-2.1-only"

diff --git a/sigma/pipelines/splunk/__init__.py b/sigma/pipelines/splunk/__init__.py
@@ -1 +1,7 @@
-from .splunk import splunk_windows_pipeline, splunk_windows_sysmon_acceleration_keywords, splunk_cim_data_model
+from .splunk import splunk_windows_pipeline, splunk_windows_sysmon_acceleration_keywords, splunk_cim_data_model
+
+pipelines = {
+    "splunk_windows": splunk_windows_pipeline,
+    "splunk_sysmon_acceleration": splunk_windows_sysmon_acceleration_keywords,
+    "splunk_cim": splunk_cim_data_model,
+}
diff --git a/sigma/pipelines/splunk/splunk.py b/sigma/pipelines/splunk/splunk.py
@@ -54,6 +54,7 @@
 def splunk_windows_pipeline():
     return ProcessingPipeline(
         name="Splunk Windows log source conditions",
+        allowed_backends={"splunk"},
         priority=20,
         items=generate_windows_logsource_items("source", "WinEventLog:{source}") + [
             ProcessingItem(     # Field mappings
@@ -68,6 +69,7 @@ def splunk_windows_pipeline():
 def splunk_windows_sysmon_acceleration_keywords():
     return ProcessingPipeline(
         name="Splunk Windows Sysmon search acceleration keywords",
+        allowed_backends={"splunk"},
         priority=25,
         items=[
             ProcessingItem(     # Some optimizations searching for characteristic keyword for specific log sources
@@ -90,6 +92,7 @@ def splunk_windows_sysmon_acceleration_keywords():
 def splunk_cim_data_model():
     return ProcessingPipeline(
         name="Splunk CIM Data Model Mapping",
+        allowed_backends={"splunk"},
         priority=20,
         items=[
             ProcessingItem(