diff --git a/docs/content/docs/artifacts/_index.md b/docs/content/docs/artifacts/_index.md index 7bc1064..17687c5 100644 --- a/docs/content/docs/artifacts/_index.md +++ b/docs/content/docs/artifacts/_index.md @@ -31,17 +31,18 @@ required_permissions: - SERVER_ADMIN parameters: - - name: PackageName - type: choices - default: Velociraptor Hayabusa Ruleset + - name: PackageNames + type: multichoice + default: '["Velociraptor Hayabusa Ruleset"]' choices: - Velociraptor Hayabusa Ruleset - Velociraptor Hayabusa Live Detection - Velociraptor ChopChopGo Ruleset (Linux) + - Velociraptor Curated Windows Ruleset - name: Prefix - description: Add artifacts with this prefix - default: Sigma. + description: Add this prefix to imported artifacts + validating_regex: '^[a-zA-Z0-9_.]*$' sources: - query: | @@ -50,7 +51,9 @@ sources: `Velociraptor Hayabusa Ruleset`="https://sigma.velocidex.com/Velociraptor-Hayabusa-Rules.zip", `Velociraptor Hayabusa Live Detection`="https://sigma.velocidex.com/Velociraptor-Hayabusa-Monitoring.zip") - SELECT * FROM Artifact.Server.Import.ArtifactExchange( - Prefix=Prefix, - ExchangeURL=get(item= URLlookup, member= PackageName)) + SELECT * FROM foreach(row=PackageNames, + query={SELECT * FROM + Artifact.Server.Import.ArtifactExchange( + Prefix=Prefix, + ExchangeURL=get(item= URLlookup, member= _value))}) ``` diff --git a/docs/content/docs/sigma_in_velociraptor/getting_curated_rules.png b/docs/content/docs/sigma_in_velociraptor/getting_curated_rules.png index c9784c6..972ecd6 100644 Binary files a/docs/content/docs/sigma_in_velociraptor/getting_curated_rules.png and b/docs/content/docs/sigma_in_velociraptor/getting_curated_rules.png differ