service_manifest.yml

name: Sigma
version: $SERVICE_TAG
description: This assemblyline service automates detection of Windows Sysmon Event logs that indicate malicious behavior.

# Regex defining the types of files the service accepts and rejects
accepts: metadata/sysmon
rejects: empty

# At which stage the service should run (one of FILTER, EXTRACT, CORE, SECONDARY, POST, REVIEW)
# NOTE: Stages are executed in the order defined in the list
stage: CORE
# Which category the service is part of (one of Antivirus, Dynamic Analysis, External, Extraction, Filtering, Internet Connected, Networking, Static Analysis)
category: Static Analysis

# Does the service require access to the file to perform its task
# If set to false, the service will only have access to the file metadata (e.g. Hashes, size, type, ...)
file_required: true
# Maximum execution time the service has before it's considered to be timed out
timeout: 200

# is the service enabled by default
enabled: true

# Service heuristic blocks: List of heuristic objects that define the different heuristics used in the service
heuristics:
  - heur_id: 1
    name: Sigma Critical alert
    score: 1000
    filetype: "*"
    description: Sigma hit
  - heur_id: 2
    name: Sigma High alert
    score: 500
    filetype: "*"
    description: Sigma hit
  - heur_id: 3
    name: Sigma Medium alert
    score: 100
    filetype: "*"
    description: Sigma hit
  - heur_id: 4
    name: Sigma Low alert
    score: 10
    filetype: "*"
    description: Sigma hit
  - heur_id: 5
    name: Sigma Info
    score: 0
    filetype: "*"
    description: Sigma hit which has no threat level

dependencies:
  updates:
    container:
      allow_internet_access: true
      command: ["python", "-m", "sigma_.update_server"]
      image: ${REGISTRY}cccs/assemblyline-service-sigma:$SERVICE_TAG
      ports: ["5003"]
      cpu_cores: 2
      ram_mb: 4096
      environment:
        - name: MAX_REQUESTS
          value: "0"
    run_as_core: True

update_config:
  generates_signatures: true
  sources:
    - name: sigma
      pattern: .*\/rules\/windows\/.*\.yml
      uri: https://github.com/SigmaHQ/sigma.git
      sync: true
  update_interval_seconds: 21600 # Quarter-day (every 6 hours)
  signature_delimiter: "file"
  wait_for_update: true

# Docker configuration block which defines:
#  - the name of the docker container that will be created
#  - cpu and ram allocation by the container
docker_config:
  allow_internet_access: true
  image: ${REGISTRY}cccs/assemblyline-service-sigma:$SERVICE_TAG
  cpu_cores: 0.4
  ram_mb: 512