regression update (#51)

Author: nasbench

sigma/validators/sigmahq/metadata.py

@@ -237,7 +237,9 @@ class SigmahqUnknownFieldValidator(SigmaRuleValidator):
 
     def validate(self, rule: SigmaRuleBase) -> List[SigmaValidationIssue]:
         if len(rule.custom_attributes) > 0:
-            return [SigmahqUnknownFieldIssue([rule], list(rule.custom_attributes.keys()))]
+            custom_keys = list(rule.custom_attributes.keys())
+            if "regression_tests_path" not in custom_keys or "simulation" not in custom_keys:
+                return [SigmahqUnknownFieldIssue([rule], custom_keys)]
         else:
             return []
 
@@ -278,7 +280,9 @@ def validate(self, rule: SigmaRuleBase) -> List[SigmaValidationIssue]:
         if rule.date is not None and rule.status is not None:
             if rule.status > SigmaStatus.EXPERIMENTAL:
                 if (datetime.now().date() - rule.date).days <= self.min_days:
-                    return [SigmahqStatusToHighIssue([rule])]
+                    custom_keys = list(rule.custom_attributes.keys())
+                    if "regression_tests_path" not in custom_keys:
+                        return [SigmahqStatusToHighIssue([rule])]
         return []
 
 

sigma/validators/sigmahq/tags.py

@@ -101,7 +101,7 @@ class SigmahqTagsTechniquesWithoutTacticsIssue(SigmaValidationIssue):
     description: ClassVar[str] = (
         "A MITRE ATT&CK technique tag was found without its corresponding tactic name. (e.g. when using 'attack.t1059' you have to add 'attack.execution' as well)"
     )
-    severity: ClassVar[SigmaValidationIssueSeverity] = SigmaValidationIssueSeverity.HIGH
+    severity: ClassVar[SigmaValidationIssueSeverity] = SigmaValidationIssueSeverity.MEDIUM
     techniques: List[str]
     missing_tactic: str
 

tests/test_metadata.py

@@ -616,6 +616,27 @@ def test_validator_SigmahqStatusToHigh_valid():
     assert validator.validate(rule) == []
 
 
+def test_validator_SigmahqStatusToHigh_with_regression_valid():
+    validator = SigmahqStatusToHighValidator()
+    rule = SigmaRule.from_yaml(
+        """
+    title: Test
+    description: Test
+    status: test
+    date: 1975-01-01
+    logsource:
+        category: test
+    detection:
+        sel:
+            candle|exists: true
+        condition: sel
+    regression_tests_path: regression/rule/test_rule.yml
+    """
+    )
+    rule.date = datetime.now().date()
+    assert validator.validate(rule) == []
+
+
 def test_validator_SigmahqGithubLink():
     validator = SigmahqGithubLinkValidator()
     rule = SigmaRule.from_yaml(