title: My example rule
detection:
  keywords:
    - foo
    - bar
  selection:
    EventId: 1234
  condition: keywords and selection

title: My example rule with a timestamp
detection:
  selection:
    Timestamp|re: ^2024-06-01T(01|02|03):[0-5][0-9]:[0-5][0-9]$
  condition: selection

title: My example rule with IP addresses
detection:
  local:
    DestinationIp|cidr:
      - "127.0.0.0/8"
      - "10.0.0.0/8"
      - "172.16.0.0/12"
      - "192.168.0.0/16"
      - "169.254.0.0/16"
      - "::1/128" # IPv6 loopback
      - "fe80::/10" # IPv6 link-local addresses
      - "fc00::/7" # IPv6 private addresses
  condition: not local

type FieldResolver interface {
    Resolve(fieldName string, entry *LogEntry) []string
}

// CustomResolver demonstrates field resolution for structured logs
type CustomResolver struct{}

func (r *CustomResolver) Resolve(fieldName string, entry *sigma.LogEntry) []string {
    switch fieldName {
    case "process.users":
        // Aggregate user fields from multiple sources
        var users []string
        if user, ok := entry.Fields["Event.Process.User"]; ok {
            users = append(users, user)
        }
        if user, ok := entry.Fields["Event.Login.User"]; ok {
            users = append(users, user)
        }
        if user, ok := entry.Fields["Event.Session.User"]; ok {
            users = append(users, user)
        }
        return users

    case "network.internal_ips":
        // Extract all IP addresses from network-related fields
        var ips []string
        for fieldName, value := range entry.Fields {
            if strings.Contains(strings.ToLower(fieldName), "ip") {
                // Simple IP validation (in real usage, use proper validation)
                if strings.Contains(value, ".") {
                    ips = append(ips, value)
                }
            }
        }
        return ips

    default:
        return nil
    }
}

func matches(detection *sigmalite.Detection) bool {
  opts := &sigmalite.MatchOptions{
		FieldResolver: CustomResolver{},
  },

  entry := &sigmalite.LogEntry{
		Message: string("Message Text"),
		Fields:  nil, // Using resolver so this can be empty
	}

	return detection.Matches(entry, opts)
}