🎨 Added field mappings to windows pipeline and changed new transformer

pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "pySigma-backend-netwitness"
-version = "0.2.3"
+version = "0.2.4"
 description = "pySigma NetWitness backend"
 readme = "README.md"
 authors = ["Marcel Kwaschny <[email protected]>"]

sigma/backends/netwitness/transformations.py

@@ -31,26 +31,21 @@ class CustomConvertTypeTransformation(ValueTransformation):
     def apply_value(self, field: str, val: SigmaType) -> Union[SigmaString, SigmaNumber, SigmaExpansion]:
         if self.target_type == "str":
             if isinstance(val, SigmaExpansion):
-                for entry in val.values:
-                    entry = SigmaString(str(entry))
+                for i, entry in enumerate(val.values):
+                    val.values[i] = SigmaString(str(entry))
+
                 return val
+
             return SigmaString(str(val))
         if self.target_type == "num":
             try:
                 if isinstance(val, SigmaExpansion):
-                    for entry in val.values:
-                        float_value = float(str(entry))
-                        if float_value.is_integer():
-                            entry = SigmaNumber(int(str(entry)))
-                        else:
-                            entry = SigmaNumber(float(str(entry)))
-                    return val
+                    for i, entry in enumerate(val.values):
+                        val.values[i] = SigmaNumber(str(entry))  # type: ignore[arg-type]
 
-                float_value = float(str(val))
-                if float_value.is_integer():
-                    return SigmaNumber(int(str(val)))
+                    return val
 
-                return SigmaNumber(float_value)
+                return SigmaNumber(str(val))  # type: ignore[arg-type]
             except SigmaValueError as error:
                 raise SigmaValueError(f"Value '{val}' can't be converted to number for {str(self)}") from error
 

sigma/pipelines/netwitness/windows.py

@@ -13,6 +13,7 @@
     "Account": "user",
     "AgentComputer": "alias.host",
     "AllUser": "user.all",
+    "AuthenticationPackageName": "auth.method",
     "CommandLine": "param",
     "DestinationIp": "ip.dst",
     "DestinationIpAddress": "ip.dst",
@@ -24,6 +25,7 @@
     "Image": "process",
     "IpAddress": "host.src",
     "IpPort": "ip.srcport",
+    "LogonProcessName": "process",
     "LogonType": "logon.type",
     "NewProcessName": "process",
     "ParentImage": "process.src",