Attributed metadata history
Up to 100 retained publisher events per page for 3fbaf9e192a7b66c90d8db584de3c40534d8fbe78a4fab31b3fe162e308b54a4. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_8c9cbb830c20534205
observed · 2026-10-12 18:48:03 UTC
available
Fingerprint: fcb07e12b5e83484e3eadc8c9f007c46a2c1ce2aa17c7bf38c70829f6cf28b17
intelligence_src_8c9cbb830c20534205
observed · 2026-10-12 18:48:03 UTC
pySigma 2.0 Introduction Breaking Changes: SigmaPolicy as Central Security Control Point pySigma 2.0 introduces SigmaPolicy — a unified security configuration framework that replaces scattered method parameters across the codebase. This is a breaking change but brings significant security and usability improvements. What Changed: Security-related settings (allow_template_vars, allow_external_sources, vars_allowed_paths, regex_engine) are no longer individual method parameters All security settings now flow through the centralized SigmaPolicy dataclass Pipeline loading methods (ProcessingPipeline.from_yaml(), from_dict()) now accept a policy parameter instead of individual flags YAML and dictionary keys for security settings are explicitly stripped before instantiation — this prevents runtime opt-ins through untrusted pipeline definitions Why This Matters: pySigma operates in two fundamentally different trust models: Private CI/CD pipelines: You control both rules and conversions — enable powerful features like template vars and external sources Public web applications: Users upload rules — features that could be exploited are disabled by default SigmaPolicy declares you
Fingerprint: 17b0eb27c03f1de64b3483450e13ab6c6eb34b53804586995f05faa97a46d87b