Skip to content

Commit a2f7226

Browse files
frack113phantinuss
frack113
and
phantinuss
authored
Version 0.10.0 (#43)
* Prepare 0.10.0 (#36) * build: 📦 Update poetry * refactor: 🔨 Fix python warning * refactor: 🔨 Enforce logsource use Keyword parameter * style: 💄 Run black * Add new tags validators (#37) * feat: ✨ Add tag verification against source name * feat: ✨ Add tag tlp allowed check * Apply suggestions from code review Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com> --------- Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com> * Refractor updated data from json file (#38) * feat: ✨ Add cli option for json source * feat: ✨ Add workflow to update data * Add Json schema verification (#39) * feat: ✨ Add json schema * feat: ✨ Add json schema workflow * fix: 🐛 Use linux path * fix: 🐛 Fix my typo * 🔨 Reworks Field name Validator logic (#40) * refactor: 🔨 Reworks SigmahqFieldnameCastValidator logic * style: 💄 Run black * More fieldname Check (#41) * feat: ✨ Add validator to check unneeded field for logsource * refactor: 🔨 Keep all json process json in one place * chore: 🧹 Update sigma.json * refactor!: 🔨 Rework the ConfigHQ class * refactor: 🔨 Change sigma.json to sigmahq_taxonomy.json * chore: rename unneeded to redundant --------- Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com> * Refactor: code and test improvements * refactor: 🔨 Review with AI tags validators * refactor: 🔨 Review with AI title validators * fix: 🐛 Fix minor errors * ci: 🤖 Add mypy * refactor: 🔨 Review with AI condition validators * refactor: 🔨 Enforce regex string * Update tests/test_condition.py --------- Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
1 parent 4261e4b commit a2f7226

40 files changed

Lines changed: 5648 additions & 5652 deletions

‎.gitattributes‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,6 @@
77
*.h text
88
*.csv text
99
*.sh text
10-
*.py text
11-
*.json text
1210
*.toml text
1311

1412
# Declare files that will always have CRLF line endings on checkout.
@@ -18,5 +16,7 @@
1816
*.png binary
1917
*.jpg binary
2018

21-
# force lf for Sigma rule
19+
# force lf for Sigma rule and python
2220
*.yml text eol=lf
21+
*.py text eol=lf
22+
*.json text eol=lf

‎.github/workflows/schema.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Validate JSON files
2+
3+
on:
4+
push:
5+
paths:
6+
- 'tools/**/*.json'
7+
- 'json-schema/**/*.json'
8+
pull_request:
9+
paths:
10+
- 'tools/**/*.json'
11+
- 'json-schema/**/*.json'
12+
13+
jobs:
14+
validate-json:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Checkout repository
18+
uses: actions/checkout@v4
19+
20+
- name: Set up Python
21+
uses: actions/setup-python@v5
22+
with:
23+
python-version: '3.12'
24+
25+
- name: Install check-jsonschema
26+
run: pip install check-jsonschema
27+
28+
- name: Validate JSON files
29+
run: |
30+
check-jsonschema --schemafile ./json-schema/schema_sigmahq_taxonomy.json ./tools/sigmahq_taxonomy.json
31+
check-jsonschema --schemafile ./json-schema/schema_sigmahq_filename.json ./tools/sigmahq_filename.json
32+
check-jsonschema --schemafile ./json-schema/schema_sigmahq_windows_validator.json ./tools/sigmahq_windows_validator.json

‎.github/workflows/update_data.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: "Update sigmahq_data.py data"
2+
3+
on:
4+
#push:
5+
# branches:
6+
# - "*"
7+
schedule:
8+
- cron: "0 0 1 * *" # At 00:00 on day-of-month 1.
9+
10+
# Allows you to run this workflow manually from the Actions tab
11+
workflow_dispatch:
12+
13+
jobs:
14+
pull-master:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- uses: actions/checkout@v4
18+
with:
19+
submodules: true
20+
- name: Set up Python 3.11
21+
uses: actions/setup-python@v5.6.0
22+
with:
23+
python-version: 3.11
24+
- name: Execute update_ref.py Script
25+
run: |
26+
pip install pySigma~=0.11
27+
pip install black~=24.4.2
28+
python tools/update_ref.py https://github.com/SigmaHQ/pySigma-validators-sigmaHQ/raw/refs/heads/main/tools/
29+
python -m black --line-length 100 sigma/validators/sigmahq/sigmahq_data.py
30+
- name: Create Pull Request
31+
uses: peter-evans/create-pull-request@v5
32+
with:
33+
reviewers: frack113, phantinuss
34+
delete-branch: true
35+
commit-message: 'chore: Update sigmahq_data.py from json files'
36+
branch: 'create-pull-request/update-data'
37+
title: 'Update sigmahq_data.py from json file'
38+
body: |
39+
### Summary of the Pull Request
40+
41+
This PR update the validator data from json files
42+
43+
### Changelog
44+
45+
chore: Update sigmahq_data.py from json files

‎.pre-commit-config.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
repos:
22
- repo: https://github.com/psf/black
3-
rev: 23.3.0
3+
rev: 24.4.2
44
hooks:
55
- id: black

‎json-schema/schema_sigmahq_filename.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"type": "object",
4+
"properties": {
5+
"title": { "type": "string" },
6+
"version": { "type": "string" },
7+
"pattern": {
8+
"type": "object",
9+
"additionalProperties": {
10+
"type": "object",
11+
"properties": {
12+
"logsource":{
13+
"type":"object",
14+
"properties": {
15+
"product": {
16+
"type": ["string", "null"]
17+
},
18+
"category": {
19+
"type": ["string", "null"]
20+
},
21+
"service": {
22+
"type": ["string", "null"]
23+
},
24+
"definition": {
25+
"type": ["string", "null"]
26+
}
27+
},
28+
"required": ["product","category","service","definition"]
29+
},
30+
"prefix":{
31+
"type": "string"
32+
}
33+
},
34+
"required": ["logsource","prefix"]
35+
}
36+
}
37+
},
38+
"required": ["title","version","pattern"]
39+
}
40+

‎json-schema/schema_sigmahq_taxonomy.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"type": "object",
4+
"properties": {
5+
"title": { "type": "string" },
6+
"version": { "type": "string" },
7+
"taxonomy": {
8+
"type": "object",
9+
"additionalProperties": {
10+
"type": "object",
11+
"properties": {
12+
"logsource":{
13+
"type":"object",
14+
"properties": {
15+
"product": {
16+
"type": ["string", "null"]
17+
},
18+
"category": {
19+
"type": ["string", "null"]
20+
},
21+
"service": {
22+
"type": ["string", "null"]
23+
},
24+
"definition": {
25+
"type": ["string", "null"]
26+
}
27+
},
28+
"required": ["product","category","service","definition"]
29+
},
30+
"description":{
31+
"type": ["string", "null"]
32+
},
33+
"field":{
34+
"type":"object",
35+
"properties": {
36+
"native": {
37+
"type":"array",
38+
"items": { "type": "string" }
39+
},
40+
"custom": {
41+
"type":"array",
42+
"items": { "type": "string" }
43+
},
44+
"redundant": {
45+
"type":"array",
46+
"items": { "type": "string" }
47+
}
48+
},
49+
"required": ["native","custom","redundant"]
50+
}
51+
},
52+
"required": ["logsource","description","field"]
53+
}
54+
}
55+
},
56+
"required": ["title","version","taxonomy"]
57+
}
58+

‎json-schema/schema_sigmahq_windows_validator.json‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"type": "object",
4+
"properties": {
5+
"title": { "type": "string" },
6+
"version": { "type": "string" },
7+
"category_no_eventid": {
8+
"type":"array",
9+
"items": { "type": "string" }
10+
},
11+
"category_provider_name": {
12+
"type": "object",
13+
"additionalProperties": {
14+
"type":"array",
15+
"items": { "type": "string" }
16+
}
17+
}
18+
},
19+
"required": ["title","version","category_no_eventid","category_provider_name"]
20+
}
21+

0 commit comments

Comments
 (0)