diff --git a/sigma/exceptions.py b/sigma/exceptions.py index aca58008..b83f8925 100644 --- a/sigma/exceptions.py +++ b/sigma/exceptions.py @@ -83,11 +83,13 @@ class SigmaDateError(SigmaError): pass + class SigmaFieldsError(SigmaError): """Error in Sigma rule fields""" pass + class SigmaFalsePositivesError(SigmaError): """Error in Sigma rule falsepositives""" diff --git a/sigma/pipelines/common.py b/sigma/pipelines/common.py index 26ad3fcf..cf58e239 100644 --- a/sigma/pipelines/common.py +++ b/sigma/pipelines/common.py @@ -66,23 +66,27 @@ def logsource_windows(service: str) -> LogsourceCondition: service=service, ) + def logsource_linux(service: str) -> LogsourceCondition: return LogsourceCondition( product="linux", service=service, ) + def logsource_macos(service: str) -> LogsourceCondition: return LogsourceCondition( product="macos", service=service, ) + def logsource_category(category: str) -> LogsourceCondition: return LogsourceCondition( category=category, ) + def logsource_windows_process_creation() -> LogsourceCondition: return LogsourceCondition( category="process_creation", @@ -273,42 +277,49 @@ def logsource_linux_file_create() -> LogsourceCondition: product="linux", ) + def logsource_macos_process_creation() -> LogsourceCondition: return LogsourceCondition( category="process_creation", product="macos", ) + def logsource_macos_file_create() -> LogsourceCondition: return LogsourceCondition( category="file_create", product="macos", ) + def logsource_azure_riskdetection() -> LogsourceCondition: return LogsourceCondition( category="riskdetection", product="azure", ) + def logsource_azure_pim() -> LogsourceCondition: return LogsourceCondition( category="pim", product="azure", ) + def logsource_azure_auditlogs() -> LogsourceCondition: return LogsourceCondition( category="auditlogs", product="azure", ) + def logsource_azure_azureactivity() -> LogsourceCondition: return LogsourceCondition( category="azureactivity", product="azure", ) + def logsource_azure_signinlogs() -> LogsourceCondition: return LogsourceCondition( category="signinlogs", diff --git a/sigma/rule.py b/sigma/rule.py index 556c8329..91c32646 100644 --- a/sigma/rule.py +++ b/sigma/rule.py @@ -715,7 +715,7 @@ def from_dict( ) ) raise SigmaTypeError("Sigma rule fields must be a list", source=source) - + # validate falsepositives rule_falsepositives = rule.get("falsepositives") if rule_falsepositives is not None and not isinstance(rule_fields, list): diff --git a/sigma/validators/core/metadata.py b/sigma/validators/core/metadata.py index a3839d23..a7f77376 100644 --- a/sigma/validators/core/metadata.py +++ b/sigma/validators/core/metadata.py @@ -51,6 +51,7 @@ def finalize(self) -> List[SigmaValidationIssue]: IdentifierCollisionIssue(rules, id) for id, rules in self.ids.items() if len(rules) > 1 ] + @dataclass class TitleLengthIssue(SigmaValidationIssue): description = "Rule has a title longer than 100 characters" @@ -66,6 +67,7 @@ def validate(self, rule: SigmaRule) -> List[SigmaValidationIssue]: else: return [] + @dataclass class DuplicateTitleIssue(SigmaValidationIssue): description: ClassVar[str] = "Rule title used by multiple rules" @@ -88,5 +90,7 @@ def validate(self, rule: SigmaRule) -> List[SigmaValidationIssue]: def finalize(self) -> List[SigmaValidationIssue]: return [ - DuplicateTitleIssue(rules, title) for title, rules in self.titles.items() if len(rules) > 1 - ] \ No newline at end of file + DuplicateTitleIssue(rules, title) + for title, rules in self.titles.items() + if len(rules) > 1 + ] diff --git a/tests/test_validators.py b/tests/test_validators.py index 3b1584a4..6d3f0b99 100644 --- a/tests/test_validators.py +++ b/tests/test_validators.py @@ -816,6 +816,7 @@ def test_validator_escaped_wildcard_valid(): ) assert validator.validate(rule) == [] + def test_validator_lengthy_title(): validator = TitleLengthValidator() rule = SigmaRule.from_yaml( @@ -832,6 +833,7 @@ def test_validator_lengthy_title(): ) assert validator.validate(rule) == [TitleLengthIssue([rule])] + def test_validator_lengthy_title_valid(): validator = TitleLengthValidator() rule = SigmaRule.from_yaml( @@ -848,6 +850,7 @@ def test_validator_lengthy_title_valid(): ) assert validator.validate(rule) == [] + def test_validator_duplicate_title(): validator = DuplicateTitleValidator() rule = SigmaRule.from_yaml( @@ -864,6 +867,7 @@ def test_validator_duplicate_title(): ) assert validator.validate(rule) == [DuplicateTitleIssue([rule])] + def test_validator_duplicate_title_valid(): validator = DuplicateTitleValidator() rule1 = SigmaRule.from_yaml( @@ -891,4 +895,4 @@ def test_validator_duplicate_title_valid(): condition: sel """ ) - assert validator.validate(rule1) == validator.validate(rule2) \ No newline at end of file + assert validator.validate(rule1) == validator.validate(rule2)