Value comparison

[trend-jason-x-lin]

Hi all,

Is there a way to compare column values with specific values such as EventId > 10?
I saw there is an aggregation with the comparison (count(UserName) by SourceWorkstation > 3) but I don't need aggregation.
Thanks!

[frack113]

Hi,
Only pySigma support value comparison

[trend-jason-x-lin]

@frack113:
Could you share the sigma syntax and how pySigma is supported?
There is a discussion SigmaHQ/sigma#218 here and the greater-than (gt) or less-than(lt) operator is not supported yet.

[frack113]

HI,
The implementation will be in the sigma specification V2.
To writte "EventId > 10" it will be EventId|gt: 10.

BUT V2 is under construction, it can be (and will be) modified or updated.