Panda-PAPS new decoders and rules

[jmmallorq]

Hello,

I created new Decoders and Rules for Panda Advanced Protection Service (PAPS) Windows application.

We used Sibling Decoders to extract all of the dynamic fields from every log event.

For the Rules, I used both <match> and <field name=""> conditions to generate the corresponding alerts. I assigned IDs from 64200 to 64208.

The script output doesn't show any "Failed" message:

# ./runtest.py
- [ File = ./tests/panda_paps.ini ] ---------
........

I upload the following files:

• decoders/0206-panda-paps_decoders.xml
• rules/0675-panda-paps_rules.xml
• tools/rules-testing/panda_paps.ini

Regards,
J. M. Mallorquín

[elwali10]

Hello @jmmallorq,

Thanks for your contribution.

I have slightly modified the decoder naming to respect the numeric order and avoid any confusion.

Best regards,
Wali