@ninoseki Hello Ninosekisan, I wondered whether you could help me with a Ruby selector query!
I’m trying to only process rows from a CSV that contain “Cobaltstrike”. I’ve tried include, match and scan, but these all return Boolean. I need the full string so I can pass to map.
@sigma_hq Hello, does the Sigma specification allow a single rule to reference both a registry_set and registry_delete logsource category?
I’m hoping to create a single rule with two detection selectors.
/cc @nas_bench
