Add generic TagFormatValidator

SigmaHQ · Sep 1, 2024 · d167d8b · d167d8b
1 parent e09a258
commit d167d8b
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 0 deletions.
diff --git a/sigma/validators/core/tags.py b/sigma/validators/core/tags.py
@@ -22,6 +22,24 @@
 import re
 
 
+@dataclass
+class InvalidTagFormatIssue(SigmaValidationIssue):
+    description: ClassVar[str] = "Invalid char in namaspace or name tag"
+    severity: ClassVar[SigmaValidationIssueSeverity] = SigmaValidationIssueSeverity.MEDIUM
+    tag: SigmaRuleTag
+
+
+class TagFormatValidator(SigmaTagValidator):
+    """Validate rule tag namespace and name allowed char"""
+
+    def validate_tag(self, tag: SigmaRuleTag) -> List[SigmaValidationIssue]:
+        tags_pattern = re.compile(r"^[a-z0-9\-\_]+\.[a-z0-9\-\_\.]+$")
+
+        if tags_pattern.match(str(tag)) is None:
+            return [InvalidTagFormatIssue([self.rule], tag)]
+        return []
+
+
 @dataclass
 class InvalidATTACKTagIssue(SigmaValidationIssue):
     description: ClassVar[str] = "Invalid MITRE ATT&CK tagging"

diff --git a/tests/test_validators_tags.py b/tests/test_validators_tags.py
@@ -24,6 +24,8 @@
     InvalidPatternTagIssue,
     NamespaceTagValidator,
     InvalidNamespaceTagIssue,
+    TagFormatValidator,
+    InvalidTagFormatIssue,
 )
 
 
@@ -234,6 +236,18 @@ def test_validator_duplicate_tags():
             [],
             InvalidNamespaceTagIssue,
         ),
+        (
+            TagFormatValidator,
+            ["custom.my tag", "custom.my2tag"],
+            ["custom.my tag"],
+            InvalidTagFormatIssue,
+        ),
+        (
+            TagFormatValidator,
+            ["custom.my_tag", "custom.my-tag"],
+            [],
+            InvalidTagFormatIssue,
+        ),
     ],
 )
 def test_validator_optional_tag(opt_validator_class, opt_tags, opt_issue_tags, opt_issue_class):