feat: ✨ Add SigmahqFieldsExistenceValidator (#63)

* feat: ✨ Add SigmahqFieldsExistenceValidator

* Apply suggestions from code review

Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>

---------

Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>

Author: frack113

sigma/validators/sigmahq/metadata.py

@@ -78,6 +78,22 @@ def validate(self, rule: SigmaRule | SigmaCorrelationRule) -> List[SigmaValidati
             return []
 
 
+@dataclass
+class SigmahqFieldsExistenceIssue(SigmaValidationIssue):
+    description: ClassVar[str] = "Rule is using the deprecated field fields"
+    severity: ClassVar[SigmaValidationIssueSeverity] = SigmaValidationIssueSeverity.MEDIUM
+
+
+class SigmahqFieldsExistenceValidator(SigmaRuleValidator):
+    """Checks if a rule is using the deprecated field fields."""
+
+    def validate(self, rule: SigmaRule | SigmaCorrelationRule) -> List[SigmaValidationIssue]:
+        if len(rule.fields) > 0:
+            return [SigmahqFieldsExistenceIssue([rule])]
+        else:
+            return []
+
+
 @dataclass
 class SigmahqModifiedDateOrderIssue(SigmaValidationIssue):
     description: ClassVar[str] = (

tests/sigmahq/metadata/test_sigmahq_fields_existence_validator.py

@@ -0,0 +1,43 @@
+from sigma.rule import SigmaRule
+from sigma.validators.sigmahq.metadata import (
+    SigmahqFieldsExistenceIssue,
+    SigmahqFieldsExistenceValidator,
+)
+
+
+def test_validator_SigmahqFieldsExistence():
+    validator = SigmahqFieldsExistenceValidator()
+    rule = SigmaRule.from_yaml(
+        """
+    title: test
+    status: stable
+    logsource:
+        category: test
+    detection:
+        sel:
+            field: path\\*something
+        condition: sel
+    fields:
+        - eventid
+        - CommandLine
+    """
+    )
+    assert validator.validate(rule) == [SigmahqFieldsExistenceIssue([rule])]
+
+
+def test_validator_SigmahqFieldsExistence_valid():
+    validator = SigmahqFieldsExistenceValidator()
+    rule = SigmaRule.from_yaml(
+        """
+    title: test
+    status: stable
+    date: 2023-12-10
+    logsource:
+        category: test
+    detection:
+        sel:
+            field: path\\*something
+        condition: sel
+    """
+    )
+    assert validator.validate(rule) == []