Skip to content

Commit

Permalink
fix: reformat code
Browse files Browse the repository at this point in the history
  • Loading branch information
nasbench committed Sep 16, 2023
1 parent 18a608d commit 20fa09d
Show file tree
Hide file tree
Showing 5 changed files with 25 additions and 4 deletions.
2 changes: 2 additions & 0 deletions sigma/exceptions.py
Original file line number Diff line number Diff line change
Expand Up @@ -83,11 +83,13 @@ class SigmaDateError(SigmaError):

pass


class SigmaFieldsError(SigmaError):
"""Error in Sigma rule fields"""

pass


class SigmaFalsePositivesError(SigmaError):
"""Error in Sigma rule falsepositives"""

Expand Down
11 changes: 11 additions & 0 deletions sigma/pipelines/common.py
Original file line number Diff line number Diff line change
Expand Up @@ -66,23 +66,27 @@ def logsource_windows(service: str) -> LogsourceCondition:
service=service,
)


def logsource_linux(service: str) -> LogsourceCondition:
return LogsourceCondition(
product="linux",
service=service,
)


def logsource_macos(service: str) -> LogsourceCondition:
return LogsourceCondition(
product="macos",
service=service,
)


def logsource_category(category: str) -> LogsourceCondition:
return LogsourceCondition(
category=category,
)


def logsource_windows_process_creation() -> LogsourceCondition:
return LogsourceCondition(
category="process_creation",
Expand Down Expand Up @@ -273,42 +277,49 @@ def logsource_linux_file_create() -> LogsourceCondition:
product="linux",
)


def logsource_macos_process_creation() -> LogsourceCondition:
return LogsourceCondition(
category="process_creation",
product="macos",
)


def logsource_macos_file_create() -> LogsourceCondition:
return LogsourceCondition(
category="file_create",
product="macos",
)


def logsource_azure_riskdetection() -> LogsourceCondition:
return LogsourceCondition(
category="riskdetection",
product="azure",
)


def logsource_azure_pim() -> LogsourceCondition:
return LogsourceCondition(
category="pim",
product="azure",
)


def logsource_azure_auditlogs() -> LogsourceCondition:
return LogsourceCondition(
category="auditlogs",
product="azure",
)


def logsource_azure_azureactivity() -> LogsourceCondition:
return LogsourceCondition(
category="azureactivity",
product="azure",
)


def logsource_azure_signinlogs() -> LogsourceCondition:
return LogsourceCondition(
category="signinlogs",
Expand Down
2 changes: 1 addition & 1 deletion sigma/rule.py
Original file line number Diff line number Diff line change
Expand Up @@ -715,7 +715,7 @@ def from_dict(
)
)
raise SigmaTypeError("Sigma rule fields must be a list", source=source)

# validate falsepositives
rule_falsepositives = rule.get("falsepositives")
if rule_falsepositives is not None and not isinstance(rule_fields, list):
Expand Down
8 changes: 6 additions & 2 deletions sigma/validators/core/metadata.py
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@ def finalize(self) -> List[SigmaValidationIssue]:
IdentifierCollisionIssue(rules, id) for id, rules in self.ids.items() if len(rules) > 1
]


@dataclass
class TitleLengthIssue(SigmaValidationIssue):
description = "Rule has a title longer than 100 characters"
Expand All @@ -66,6 +67,7 @@ def validate(self, rule: SigmaRule) -> List[SigmaValidationIssue]:
else:
return []


@dataclass
class DuplicateTitleIssue(SigmaValidationIssue):
description: ClassVar[str] = "Rule title used by multiple rules"
Expand All @@ -88,5 +90,7 @@ def validate(self, rule: SigmaRule) -> List[SigmaValidationIssue]:

def finalize(self) -> List[SigmaValidationIssue]:
return [
DuplicateTitleIssue(rules, title) for title, rules in self.titles.items() if len(rules) > 1
]
DuplicateTitleIssue(rules, title)
for title, rules in self.titles.items()
if len(rules) > 1
]
6 changes: 5 additions & 1 deletion tests/test_validators.py
Original file line number Diff line number Diff line change
Expand Up @@ -816,6 +816,7 @@ def test_validator_escaped_wildcard_valid():
)
assert validator.validate(rule) == []


def test_validator_lengthy_title():
validator = TitleLengthValidator()
rule = SigmaRule.from_yaml(
Expand All @@ -832,6 +833,7 @@ def test_validator_lengthy_title():
)
assert validator.validate(rule) == [TitleLengthIssue([rule])]


def test_validator_lengthy_title_valid():
validator = TitleLengthValidator()
rule = SigmaRule.from_yaml(
Expand All @@ -848,6 +850,7 @@ def test_validator_lengthy_title_valid():
)
assert validator.validate(rule) == []


def test_validator_duplicate_title():
validator = DuplicateTitleValidator()
rule = SigmaRule.from_yaml(
Expand All @@ -864,6 +867,7 @@ def test_validator_duplicate_title():
)
assert validator.validate(rule) == [DuplicateTitleIssue([rule])]


def test_validator_duplicate_title_valid():
validator = DuplicateTitleValidator()
rule1 = SigmaRule.from_yaml(
Expand Down Expand Up @@ -891,4 +895,4 @@ def test_validator_duplicate_title_valid():
condition: sel
"""
)
assert validator.validate(rule1) == validator.validate(rule2)
assert validator.validate(rule1) == validator.validate(rule2)

0 comments on commit 20fa09d

Please sign in to comment.