Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: small updates and additions #147

Merged
merged 8 commits into from
Sep 18, 2023
Merged

Conversation

nasbench
Copy link
Member

This PR includes the following changes:

  • Updated windows log source mapping
  • Added missing functions to the pipelines commons for linux, mac and azure categories and service
  • Added missing type hints in common.py functions
  • Added new function logsource_category to allow for generic LogSourceCondition generation based on any category from rules such as proxy, dns, etc.
  • Added check in rule.py for status field instance to be a string. Because in cases where a rule contained a list it will throw an exception due to usage of .upper attribute on non strings.
  • Similar to the fields check raised in 'Fields' field: Possible enhancement #122. I added one for falsepositives field to always be a list
  • Added 2 exceptions classes SigmaFieldsError and SigmaFalsePositivesError to be raised in errors in those fields and to follow the code style used in rule.py
  • Added missing sysmon events to logsources.py

Also started migrating some tests from SigmaHQ test scripts. I added the following

  • Duplicate titles
  • Lengthy titles (>100)

@thomaspatzke thomaspatzke merged commit 6f1c588 into SigmaHQ:main Sep 18, 2023
12 checks passed
@thomaspatzke
Copy link
Member

Don't call this small! 😁

@thomaspatzke
Copy link
Member

FYI: fixed test_validator_duplicate_title, it didn't tested the finalize method that finally outputs the issue object. Previoustest only compared the empty lists returned by the validate calls.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants