Merge pull request #1407 from Yamato-Security/1406-create-supported-f…

…ield-modifiers feat: add script and actions for supported modifier markdown
Yamato-Security · Sep 1, 2024 · d66e9df · d66e9df
2 parents 02200b4 + ac9912c
commit d66e9df
Show file tree

Hide file tree

Showing 6 changed files with 552 additions and 0 deletions.
diff --git a/.github/workflows/supported_modifier.yml b/.github/workflows/supported_modifier.yml
@@ -0,0 +1,103 @@
+name: Pipeline for creating supported modifier markdown
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 20 * * *'
+
+jobs:
+  updateMarkDown:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone hayabusa repo
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: hayabusa
+
+      - name: Clone Sigma
+        uses: actions/checkout@v4
+        with:
+          repository: SigmaHQ/sigma
+          path: sigma-repo
+          token: ${{ secrets.GITHUB_TOKEN }} ## This is necessary for executing on a local machine by act(Local GitHub Action Runner). We have to specify the github token explicitly.
+
+      - name: Clone hayabusa rule repo
+        uses: actions/checkout@v4
+        with:
+          repository: Yamato-Security/hayabusa-rules
+          path: hayabusa-rules-repo
+          token: ${{ secrets.GITHUB_TOKEN }} ## This is necessary for executing on a local machine by act(Local GitHub Action Runner). We have to specify the github token explicitly.
+
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+          architecture: 'x64'
+
+      - name: Setup Poetry
+        run: |
+          curl -sSL https://install.python-poetry.org | python3 -
+
+      - name: Create markdown
+        run: |
+          cd hayabusa/scripts/supported_modifiers_check
+          poetry install --no-root
+          poetry run python supported-modifier.py ../../../sigma-repo ../../../hayabusa-rules ../../doc/SupportedSigmaFieldModifiers.md
+
+      - name: Create Text
+        id: create-text
+        run: |
+          pushd hayabusa
+          echo "action_date=$(date '+%Y-%m-%d  %H:%M:%S')" >> $GITHUB_ENV
+          echo "change_exist=true" >> $GITHUB_ENV
+          git_new=$(git diff --name-status --diff-filter=AC)
+          git_mod=$(git diff --name-status --diff-filter=MR)
+          git_del=$(git diff --name-status --diff-filter=D)
+          is_rule_changed=$(git status)
+          if [ "${is_rule_changed}" =~ nothing\sto\scommit ]; then
+            echo "change_exist=false" >> $GITHUB_ENV
+          else
+          	echo "<details><summary>New files</summary>" >> ../changed_rule.logs
+          	echo "${git_new}" >> ../changed_rule.logs
+          	echo "</details>" >> ../changed_rule.logs
+          	echo "<details><summary>Modified files</summary>" >> ../changed_rule.logs
+          	echo "${git_mod}" >> ../changed_rule.logs
+          	echo "</details>" >> ../changed_rule.logs
+          	echo "<details><summary>Deleted files</summary>" >> ../changed_rule.logs
+          	echo "${git_del}" >> ../changed_rule.logs
+          	echo "</details>" >> ../changed_rule.logs
+          fi
+          popd
+
+      - name: Create Pull Request
+        if: env.change_exist == 'true'
+        id: cpr
+        uses: peter-evans/create-pull-request@v4
+        with:
+          path: hayabusa
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: Sigma Rule Supported Modifier Update (${{ env.action_date }})
+          branch: auto-sigma-supported-modifier-update
+          delete-branch: true
+          title: '[Auto] Sigma Rule Supported Modifier Update report(${{ env.action_date }})' ### If a PR with the same name already exists, this github action library will not create a new pull request but it will update the PR with the same name. Therefore I added the date to the pull request's title so it creates a new PR.
+          branch-suffix: timestamp ### I use this field in order to avoid name duplication. If the pull request which is related to the same branch exists, the pull request is not newly created but is updated. So the next step will be skipped due to its if-field
+          body: |
+            ${{ env.action_date }} Update report
+
+      - name: Enable Pull Request Automerge
+        if: steps.cpr.outputs.pull-request-operation == 'created' # This only runs if there were sigma rules updates and a new PR was created.
+        uses: peter-evans/enable-pull-request-automerge@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          pull-request-number: ${{ steps.cpr.outputs.pull-request-number }}
+          merge-method: squash
+
+      - name: upload change log
+        if: env.change_exist == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: changed_rule_log
+          path: ${{ github.workspace }}/changed_rule.logs
+          retention-days: 30
diff --git a/doc/SupportedSigmaFieldModifiers.md b/doc/SupportedSigmaFieldModifiers.md
@@ -0,0 +1,38 @@
+# Hayabusa supported field modifiers
+| Field Modifier        |   Sigma Count |   Hayabusa Count |
+|:----------------------|--------------:|-----------------:|
+| all                   |            13 |                0 |
+| base64offsetǀcontains |             7 |                0 |
+| cased                 |             0 |                0 |
+| cidr                  |            34 |                0 |
+| contains              |          2738 |                9 |
+| containsǀall          |           970 |                0 |
+| containsǀallǀwindash  |             4 |                0 |
+| containsǀwindash      |            76 |                0 |
+| endswith              |          2893 |               34 |
+| endswithfield         |             0 |                1 |
+| endswithǀwindash      |             1 |                0 |
+| equalsfield           |             0 |                1 |
+| exists                |             0 |                0 |
+| re                    |           165 |                9 |
+| reǀi                  |             0 |                0 |
+| reǀm                  |             0 |                0 |
+| reǀs                  |             0 |                0 |
+| startswith            |           436 |                6 |
+
+# Hayabusa unsupported field modifiers
+| Field Modifier   |   Sigma Count |   Hayabusa Count |
+|:-----------------|--------------:|-----------------:|
+| base64ǀutf16be   |             0 |                0 |
+| base64ǀutf16le   |             0 |                0 |
+| base64ǀwide      |             0 |                0 |
+| containsǀexpand  |             1 |                0 |
+| expand           |             8 |                0 |
+| fieldref         |             0 |                0 |
+| gt               |             0 |                0 |
+| gte              |             0 |                0 |
+| lt               |             0 |                0 |
+| lte              |             0 |                0 |
+
+Updated: 2024/09/02  
+Author: Fukusuke Takahashi
diff --git a/scripts/supported_modifiers_check/README.md b/scripts/supported_modifiers_check/README.md
@@ -0,0 +1,21 @@
+# About
+
+This script will create a markdown table of the field modifiers being used by Sigma and tell if Hayabusa supports the modifiers or not.
+
+# How to use
+## Run locally
+1. `git clone https://github.com/SigmaHQ/sigma`
+2. `git clone https://github.com/Yamato-Security/hayabusa-rules.git`
+3. `git clone https://github.com/Yamato-Security/hayabusa.git`
+4. `cd hayabusa/scripts/supported_modifiers_check`
+5. `poetry install --no-root`
+6. `poetry python supported-modifier.py ../sigma ../hayabusa-rules ../../doc/SupportedSigmaFieldModifiers.md`
+
+## Run Actions
+- Manual: https://github.com/fukusuket/hayabusa/actions/runs/10643011211/job/29506086051
+- Schedule: `cron: '0 20 * * *'`
+
+# Authors
+
+Fukusuke Takahashi
+Zach Mathis