pax_global_header00006660000000000000000000000064151710116610014511gustar00rootroot0000000000000052 comment=dec5983fd9d86df0ebdbc5246171a53b9e9cb98e SigmaHQ-sigma-cli-f40f47a/000077500000000000000000000000001517101166100152625ustar00rootroot00000000000000SigmaHQ-sigma-cli-f40f47a/.git-blame-ignore-revs000066400000000000000000000002151517101166100213600ustar00rootroot00000000000000# Reformatting by black a6b11efb3455b0d13d4d712413052061580d43c4 # Set line-length to 100 for black 17185b23e5d18f0977eaf0f96bd941fb6c8d53f1 SigmaHQ-sigma-cli-f40f47a/.github/000077500000000000000000000000001517101166100166225ustar00rootroot00000000000000SigmaHQ-sigma-cli-f40f47a/.github/FUNDING.yml000066400000000000000000000013441517101166100204410ustar00rootroot00000000000000# These are supported funding model platforms github: [thomaspatzke] patreon: # Replace with a single Patreon username open_collective: # Replace with a single Open Collective username ko_fi: # Replace with a single Ko-fi username tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry liberapay: # Replace with a single Liberapay username issuehunt: # Replace with a single IssueHunt username otechie: # Replace with a single Otechie username lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'] SigmaHQ-sigma-cli-f40f47a/.github/workflows/000077500000000000000000000000001517101166100206575ustar00rootroot00000000000000SigmaHQ-sigma-cli-f40f47a/.github/workflows/release.yml000066400000000000000000000020401517101166100230160ustar00rootroot00000000000000name: Release to PyPI on: release: types: [published] push: tags: - v*.*.* jobs: build-and-publish: runs-on: ubuntu-24.04 environment: release permissions: id-token: write steps: - uses: actions/checkout@v4 - name: Install Poetry run: pipx install poetry - name: Set up Python uses: actions/setup-python@v4 with: python-version: '3.13' - name: Verify versioning run: | [ "$(poetry version -s)" == "${GITHUB_REF#refs/tags/v}" ] - name: Install dependencies run: poetry install - name: Run tests run: poetry run pytest - name: Build packages run: poetry build - name: Publish to test PyPI if: ${{ github.event_name == 'push' }} uses: pypa/gh-action-pypi-publish@release/v1 with: repository-url: https://test.pypi.org/legacy/ - name: Publish to PyPI if: ${{ github.event_name == 'release' }} uses: pypa/gh-action-pypi-publish@release/v1SigmaHQ-sigma-cli-f40f47a/.github/workflows/test.yml000066400000000000000000000024571517101166100223710ustar00rootroot00000000000000name: Test on: push: branches: ["*"] pull_request: branches: ["*"] workflow_dispatch: jobs: test: strategy: matrix: os: ["ubuntu-latest", "windows-latest", "macos-latest"] python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"] runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@v4 - name: Install Poetry run: pipx install poetry - name: Set up Python uses: actions/setup-python@v4 with: python-version: ${{ matrix.python-version }} - name: Install dependencies run: poetry install - name: Run tests run: poetry run pytest --cov=sigma --cov-report term --cov-report xml:cov.xml -vv - name: Store coverage for badge if: ${{ runner.os == 'Linux' }} run: poetry run python print-coverage.py >> $GITHUB_ENV - name: Create coverage badge if: ${{ github.repository == 'SigmaHQ/sigma-cli' && github.event_name == 'push' && runner.os == 'Linux' }} uses: schneegans/dynamic-badges-action@v1.7.0 with: auth: ${{ secrets.GIST_SECRET }} gistID: 0c868df261d4a5d5a1dafe71b1557d69 filename: SigmaHQ-sigma-cli.json label: Coverage message: ${{ env.COVERAGE }} color: ${{ env.COVERAGE_COLOR }} SigmaHQ-sigma-cli-f40f47a/.gitignore000066400000000000000000000001031517101166100172440ustar00rootroot00000000000000.coverage* .vscode/ **/__pycache__ cov.xml dist/ docs/_build SigmaHQ-sigma-cli-f40f47a/.pre-commit-config.yaml000066400000000000000000000001321517101166100215370ustar00rootroot00000000000000repos: - repo: https://github.com/psf/black rev: 23.3.0 hooks: - id: blackSigmaHQ-sigma-cli-f40f47a/README.md000066400000000000000000000072771517101166100165560ustar00rootroot00000000000000# Sigma Command Line Interface ![Tests](https://github.com/SigmaHQ/sigma-cli/actions/workflows/test.yml/badge.svg) ![Coverage Badge](https://img.shields.io/endpoint?url=https://gist.githubusercontent.com/thomaspatzke/0c868df261d4a5d5a1dafe71b1557d69/raw/SigmaHQ-sigma-cli.json) ![Status](https://img.shields.io/badge/Status-pre--release-orange) This is the Sigma command line interface using the [pySigma](https://github.com/SigmaHQ/pySigma) library to manage, list and convert Sigma rules into query languages. ## Getting Started ### Installation The easiest way to install the Sigma CLI is via *pipx* or *pip*. For this purpose run one of the following: ``` python -m pipx install sigma-cli python -m pip install sigma-cli ``` on macOS use ``` python3 -m pip install sigma-cli ``` Another way is to run this from source in a virtual environment managed by [Poetry](https://python-poetry.org/docs/basic-usage/): ``` git clone https://github.com/SigmaHQ/sigma-cli.git cd sigma-cli poetry install poetry shell ``` ### Usage The CLI is available as *sigma* command. A typical invocation is: ``` sigma convert -t -p -p [...] ``` E.g. to convert process creation Sigma rules from a directory into Splunk queries for Sysmon logs run: ``` sigma convert -t splunk -p sysmon sigma/rules/windows/process_creation ``` Required backends must be installed using the following command prior to conducting conversions. To list all available plugins run the following command: ``` sigma plugin list ``` Install a plugin of your choice with: ``` sigma plugin install ``` E.g. to install the splunk backend run: ``` sigma plugin install splunk ``` Available conversion backends and processing pipelines can be listed with `sigma list`. Use `-O` or `--backend-option` for passing options to the backend as key=value pairs (`-O testparam=123`) . This backend option parameter can be used multiple times (`-O first=123 -O second=456`). Backends can support different output formats, e.g. plain queries and a file that can be imported into the target system. These formats can be listed with `sigma list formats ` and specified for conversion with the `-f` option. In addition, an output file can be specified with `-o`. Example for output formats and files: ``` sigma convert -t splunk -f savedsearches -p sysmon -o savedsearches.conf sigma/rules/windows/process_creation ``` Outputs a Splunk savedsearches.conf containing the converted searches. ### Integration of Backends and Pipelines Backends and pipelines can be integrated by adding the corresponding packages as dependency with: ``` poetry add ``` A backend has to be added to the `backends` dict in `sigma/cli/backends.py` by creation of a `Backend` named tuple with the following parameters: * The backend class. * A display name shown to the user in the targets list (`sigma list targets`). * A dict that maps output format names (used in `-f` parameter) to descriptions of the formats that are shown in the format list (`sigma list formats `). The formats must be supported by the backend! The dict key is the name used in the `-t` parameter. A processing pipeline is defined in the `pipelines` variable dict in `sigma/cli/pipelines.py`. The variable contains a `ProcessingPipelineResolver` that is instantiated with a dict that maps identifiers that can be used in the `-p` parameter to functions that return `ProcessingPipeline` objects. The descriptive text shown in the pipeline list (`sigma list pipelines`) is provided from the `name` attribute of the `ProcessingPipeline` object. ## Maintainers The project is currently maintained by: - Thomas Patzke SigmaHQ-sigma-cli-f40f47a/poetry.lock000066400000000000000000002476601517101166100174750ustar00rootroot00000000000000# This file is automatically @generated by Poetry 2.3.2 and should not be changed by hand. [[package]] name = "certifi" version = "2026.2.25" description = "Python package for providing Mozilla's CA Bundle." optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "certifi-2026.2.25-py3-none-any.whl", hash = "sha256:027692e4402ad994f1c42e52a4997a9763c646b73e4096e4d5d6db8af1d6f0fa"}, {file = "certifi-2026.2.25.tar.gz", hash = "sha256:e887ab5cee78ea814d3472169153c2d12cd43b14bd03329a39a9c6e2e80bfba7"}, ] [[package]] name = "charset-normalizer" version = "3.4.7" description = "The Real First Universal Charset Detector. Open, modern and actively maintained alternative to Chardet." optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "charset_normalizer-3.4.7-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:cdd68a1fb318e290a2077696b7eb7a21a49163c455979c639bf5a5dcdc46617d"}, {file = "charset_normalizer-3.4.7-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e17b8d5d6a8c47c85e68ca8379def1303fd360c3e22093a807cd34a71cd082b8"}, {file = "charset_normalizer-3.4.7-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:511ef87c8aec0783e08ac18565a16d435372bc1ac25a91e6ac7f5ef2b0bff790"}, {file = "charset_normalizer-3.4.7-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:007d05ec7321d12a40227aae9e2bc6dca73f3cb21058999a1df9e193555a9dcc"}, {file = "charset_normalizer-3.4.7-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:cf29836da5119f3c8a8a70667b0ef5fdca3bb12f80fd06487cfa575b3909b393"}, {file = "charset_normalizer-3.4.7-cp310-cp310-manylinux_2_31_armv7l.whl", hash = "sha256:12d8baf840cc7889b37c7c770f478adea7adce3dcb3944d02ec87508e2dcf153"}, {file = "charset_normalizer-3.4.7-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:d560742f3c0d62afaccf9f41fe485ed69bd7661a241f86a3ef0f0fb8b1a397af"}, {file = "charset_normalizer-3.4.7-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:b14b2d9dac08e28bb8046a1a0434b1750eb221c8f5b87a68f4fa11a6f97b5e34"}, {file = "charset_normalizer-3.4.7-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:bc17a677b21b3502a21f66a8cc64f5bfad4df8a0b8434d661666f8ce90ac3af1"}, {file = "charset_normalizer-3.4.7-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:750e02e074872a3fad7f233b47734166440af3cdea0add3e95163110816d6752"}, {file = "charset_normalizer-3.4.7-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:4e5163c14bffd570ef2affbfdd77bba66383890797df43dc8b4cc7d6f500bf53"}, {file = "charset_normalizer-3.4.7-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:6ed74185b2db44f41ef35fd1617c5888e59792da9bbc9190d6c7300617182616"}, {file = "charset_normalizer-3.4.7-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:94e1885b270625a9a828c9793b4d52a64445299baa1fea5a173bf1d3dd9a1a5a"}, {file = "charset_normalizer-3.4.7-cp310-cp310-win32.whl", hash = "sha256:6785f414ae0f3c733c437e0f3929197934f526d19dfaa75e18fdb4f94c6fb374"}, {file = "charset_normalizer-3.4.7-cp310-cp310-win_amd64.whl", hash = "sha256:6696b7688f54f5af4462118f0bfa7c1621eeb87154f77fa04b9295ce7a8f2943"}, {file = "charset_normalizer-3.4.7-cp310-cp310-win_arm64.whl", hash = "sha256:66671f93accb62ed07da56613636f3641f1a12c13046ce91ffc923721f23c008"}, {file = "charset_normalizer-3.4.7-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:7641bb8895e77f921102f72833904dcd9901df5d6d72a2ab8f31d04b7e51e4e7"}, {file = "charset_normalizer-3.4.7-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:202389074300232baeb53ae2569a60901f7efadd4245cf3a3bf0617d60b439d7"}, {file = "charset_normalizer-3.4.7-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:30b8d1d8c52a48c2c5690e152c169b673487a2a58de1ec7393196753063fcd5e"}, {file = "charset_normalizer-3.4.7-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:532bc9bf33a68613fd7d65e4b1c71a6a38d7d42604ecf239c77392e9b4e8998c"}, {file = "charset_normalizer-3.4.7-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:2fe249cb4651fd12605b7288b24751d8bfd46d35f12a20b1ba33dea122e690df"}, {file = "charset_normalizer-3.4.7-cp311-cp311-manylinux_2_31_armv7l.whl", hash = "sha256:65bcd23054beab4d166035cabbc868a09c1a49d1efe458fe8e4361215df40265"}, {file = "charset_normalizer-3.4.7-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:08e721811161356f97b4059a9ba7bafb23ea5ee2255402c42881c214e173c6b4"}, {file = "charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:e060d01aec0a910bdccb8be71faf34e7799ce36950f8294c8bf612cba65a2c9e"}, {file = "charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:38c0109396c4cfc574d502df99742a45c72c08eff0a36158b6f04000043dbf38"}, {file = "charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:1c2a768fdd44ee4a9339a9b0b130049139b8ce3c01d2ce09f67f5a68048d477c"}, {file = "charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:1a87ca9d5df6fe460483d9a5bbf2b18f620cbed41b432e2bddb686228282d10b"}, {file = "charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:d635aab80466bc95771bb78d5370e74d36d1fe31467b6b29b8b57b2a3cd7d22c"}, {file = "charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:ae196f021b5e7c78e918242d217db021ed2a6ace2bc6ae94c0fc596221c7f58d"}, {file = "charset_normalizer-3.4.7-cp311-cp311-win32.whl", hash = "sha256:adb2597b428735679446b46c8badf467b4ca5f5056aae4d51a19f9570301b1ad"}, {file = "charset_normalizer-3.4.7-cp311-cp311-win_amd64.whl", hash = "sha256:8e385e4267ab76874ae30db04c627faaaf0b509e1ccc11a95b3fc3e83f855c00"}, {file = "charset_normalizer-3.4.7-cp311-cp311-win_arm64.whl", hash = "sha256:d4a48e5b3c2a489fae013b7589308a40146ee081f6f509e047e0e096084ceca1"}, {file = "charset_normalizer-3.4.7-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:eca9705049ad3c7345d574e3510665cb2cf844c2f2dcfe675332677f081cbd46"}, {file = "charset_normalizer-3.4.7-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6178f72c5508bfc5fd446a5905e698c6212932f25bcdd4b47a757a50605a90e2"}, {file = "charset_normalizer-3.4.7-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:e1421b502d83040e6d7fb2fb18dff63957f720da3d77b2fbd3187ceb63755d7b"}, {file = "charset_normalizer-3.4.7-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:edac0f1ab77644605be2cbba52e6b7f630731fc42b34cb0f634be1a6eface56a"}, {file = "charset_normalizer-3.4.7-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5649fd1c7bade02f320a462fdefd0b4bd3ce036065836d4f42e0de958038e116"}, {file = "charset_normalizer-3.4.7-cp312-cp312-manylinux_2_31_armv7l.whl", hash = "sha256:203104ed3e428044fd943bc4bf45fa73c0730391f9621e37fe39ecf477b128cb"}, {file = "charset_normalizer-3.4.7-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:298930cec56029e05497a76988377cbd7457ba864beeea92ad7e844fe74cd1f1"}, {file = "charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:708838739abf24b2ceb208d0e22403dd018faeef86ddac04319a62ae884c4f15"}, {file = "charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:0f7eb884681e3938906ed0434f20c63046eacd0111c4ba96f27b76084cd679f5"}, {file = "charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:4dc1e73c36828f982bfe79fadf5919923f8a6f4df2860804db9a98c48824ce8d"}, {file = "charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:aed52fea0513bac0ccde438c188c8a471c4e0f457c2dd20cdbf6ea7a450046c7"}, {file = "charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:fea24543955a6a729c45a73fe90e08c743f0b3334bbf3201e6c4bc1b0c7fa464"}, {file = "charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:bb6d88045545b26da47aa879dd4a89a71d1dce0f0e549b1abcb31dfe4a8eac49"}, {file = "charset_normalizer-3.4.7-cp312-cp312-win32.whl", hash = "sha256:2257141f39fe65a3fdf38aeccae4b953e5f3b3324f4ff0daf9f15b8518666a2c"}, {file = "charset_normalizer-3.4.7-cp312-cp312-win_amd64.whl", hash = "sha256:5ed6ab538499c8644b8a3e18debabcd7ce684f3fa91cf867521a7a0279cab2d6"}, {file = "charset_normalizer-3.4.7-cp312-cp312-win_arm64.whl", hash = "sha256:56be790f86bfb2c98fb742ce566dfb4816e5a83384616ab59c49e0604d49c51d"}, {file = "charset_normalizer-3.4.7-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:f496c9c3cc02230093d8330875c4c3cdfc3b73612a5fd921c65d39cbcef08063"}, {file = "charset_normalizer-3.4.7-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0ea948db76d31190bf08bd371623927ee1339d5f2a0b4b1b4a4439a65298703c"}, {file = "charset_normalizer-3.4.7-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:a277ab8928b9f299723bc1a2dabb1265911b1a76341f90a510368ca44ad9ab66"}, {file = "charset_normalizer-3.4.7-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:3bec022aec2c514d9cf199522a802bd007cd588ab17ab2525f20f9c34d067c18"}, {file = "charset_normalizer-3.4.7-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e044c39e41b92c845bc815e5ae4230804e8e7bc29e399b0437d64222d92809dd"}, {file = "charset_normalizer-3.4.7-cp313-cp313-manylinux_2_31_armv7l.whl", hash = "sha256:f495a1652cf3fbab2eb0639776dad966c2fb874d79d87ca07f9d5f059b8bd215"}, {file = "charset_normalizer-3.4.7-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:e712b419df8ba5e42b226c510472b37bd57b38e897d3eca5e8cfd410a29fa859"}, {file = "charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:7804338df6fcc08105c7745f1502ba68d900f45fd770d5bdd5288ddccb8a42d8"}, {file = "charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:481551899c856c704d58119b5025793fa6730adda3571971af568f66d2424bb5"}, {file = "charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:f59099f9b66f0d7145115e6f80dd8b1d847176df89b234a5a6b3f00437aa0832"}, {file = "charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:f59ad4c0e8f6bba240a9bb85504faa1ab438237199d4cce5f622761507b8f6a6"}, {file = "charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:3dedcc22d73ec993f42055eff4fcfed9318d1eeb9a6606c55892a26964964e48"}, {file = "charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:64f02c6841d7d83f832cd97ccf8eb8a906d06eb95d5276069175c696b024b60a"}, {file = "charset_normalizer-3.4.7-cp313-cp313-win32.whl", hash = "sha256:4042d5c8f957e15221d423ba781e85d553722fc4113f523f2feb7b188cc34c5e"}, {file = "charset_normalizer-3.4.7-cp313-cp313-win_amd64.whl", hash = "sha256:3946fa46a0cf3e4c8cb1cc52f56bb536310d34f25f01ca9b6c16afa767dab110"}, {file = "charset_normalizer-3.4.7-cp313-cp313-win_arm64.whl", hash = "sha256:80d04837f55fc81da168b98de4f4b797ef007fc8a79ab71c6ec9bc4dd662b15b"}, {file = "charset_normalizer-3.4.7-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:c36c333c39be2dbca264d7803333c896ab8fa7d4d6f0ab7edb7dfd7aea6e98c0"}, {file = "charset_normalizer-3.4.7-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1c2aed2e5e41f24ea8ef1590b8e848a79b56f3a5564a65ceec43c9d692dc7d8a"}, {file = "charset_normalizer-3.4.7-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:54523e136b8948060c0fa0bc7b1b50c32c186f2fceee897a495406bb6e311d2b"}, {file = "charset_normalizer-3.4.7-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:715479b9a2802ecac752a3b0efa2b0b60285cf962ee38414211abdfccc233b41"}, {file = "charset_normalizer-3.4.7-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bd6c2a1c7573c64738d716488d2cdd3c00e340e4835707d8fdb8dc1a66ef164e"}, {file = "charset_normalizer-3.4.7-cp314-cp314-manylinux_2_31_armv7l.whl", hash = "sha256:c45e9440fb78f8ddabcf714b68f936737a121355bf59f3907f4e17721b9d1aae"}, {file = "charset_normalizer-3.4.7-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:3534e7dcbdcf757da6b85a0bbf5b6868786d5982dd959b065e65481644817a18"}, {file = "charset_normalizer-3.4.7-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:e8ac484bf18ce6975760921bb6148041faa8fef0547200386ea0b52b5d27bf7b"}, {file = "charset_normalizer-3.4.7-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:a5fe03b42827c13cdccd08e6c0247b6a6d4b5e3cdc53fd1749f5896adcdc2356"}, {file = "charset_normalizer-3.4.7-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:2d6eb928e13016cea4f1f21d1e10c1cebd5a421bc57ddf5b1142ae3f86824fab"}, {file = "charset_normalizer-3.4.7-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:e74327fb75de8986940def6e8dee4f127cc9752bee7355bb323cc5b2659b6d46"}, {file = "charset_normalizer-3.4.7-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:d6038d37043bced98a66e68d3aa2b6a35505dc01328cd65217cefe82f25def44"}, {file = "charset_normalizer-3.4.7-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:7579e913a5339fb8fa133f6bbcfd8e6749696206cf05acdbdca71a1b436d8e72"}, {file = "charset_normalizer-3.4.7-cp314-cp314-win32.whl", hash = "sha256:5b77459df20e08151cd6f8b9ef8ef1f961ef73d85c21a555c7eed5b79410ec10"}, {file = "charset_normalizer-3.4.7-cp314-cp314-win_amd64.whl", hash = "sha256:92a0a01ead5e668468e952e4238cccd7c537364eb7d851ab144ab6627dbbe12f"}, {file = "charset_normalizer-3.4.7-cp314-cp314-win_arm64.whl", hash = "sha256:67f6279d125ca0046a7fd386d01b311c6363844deac3e5b069b514ba3e63c246"}, {file = "charset_normalizer-3.4.7-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:effc3f449787117233702311a1b7d8f59cba9ced946ba727bdc329ec69028e24"}, {file = "charset_normalizer-3.4.7-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:fbccdc05410c9ee21bbf16a35f4c1d16123dcdeb8a1d38f33654fa21d0234f79"}, {file = "charset_normalizer-3.4.7-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:733784b6d6def852c814bce5f318d25da2ee65dd4839a0718641c696e09a2960"}, {file = "charset_normalizer-3.4.7-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a89c23ef8d2c6b27fd200a42aa4ac72786e7c60d40efdc76e6011260b6e949c4"}, {file = "charset_normalizer-3.4.7-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6c114670c45346afedc0d947faf3c7f701051d2518b943679c8ff88befe14f8e"}, {file = "charset_normalizer-3.4.7-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:a180c5e59792af262bf263b21a3c49353f25945d8d9f70628e73de370d55e1e1"}, {file = "charset_normalizer-3.4.7-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:3c9a494bc5ec77d43cea229c4f6db1e4d8fe7e1bbffa8b6f0f0032430ff8ab44"}, {file = "charset_normalizer-3.4.7-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:8d828b6667a32a728a1ad1d93957cdf37489c57b97ae6c4de2860fa749b8fc1e"}, {file = "charset_normalizer-3.4.7-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:cf1493cd8607bec4d8a7b9b004e699fcf8f9103a9284cc94962cb73d20f9d4a3"}, {file = "charset_normalizer-3.4.7-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:0c96c3b819b5c3e9e165495db84d41914d6894d55181d2d108cc1a69bfc9cce0"}, {file = "charset_normalizer-3.4.7-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:752a45dc4a6934060b3b0dab47e04edc3326575f82be64bc4fc293914566503e"}, {file = "charset_normalizer-3.4.7-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:8778f0c7a52e56f75d12dae53ae320fae900a8b9b4164b981b9c5ce059cd1fcb"}, {file = "charset_normalizer-3.4.7-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:ce3412fbe1e31eb81ea42f4169ed94861c56e643189e1e75f0041f3fe7020abe"}, {file = "charset_normalizer-3.4.7-cp314-cp314t-win32.whl", hash = "sha256:c03a41a8784091e67a39648f70c5f97b5b6a37f216896d44d2cdcb82615339a0"}, {file = "charset_normalizer-3.4.7-cp314-cp314t-win_amd64.whl", hash = "sha256:03853ed82eeebbce3c2abfdbc98c96dc205f32a79627688ac9a27370ea61a49c"}, {file = "charset_normalizer-3.4.7-cp314-cp314t-win_arm64.whl", hash = "sha256:c35abb8bfff0185efac5878da64c45dafd2b37fb0383add1be155a763c1f083d"}, {file = "charset_normalizer-3.4.7-cp38-cp38-macosx_10_9_universal2.whl", hash = "sha256:e5f4d355f0a2b1a31bc3edec6795b46324349c9cb25eed068049e4f472fb4259"}, {file = "charset_normalizer-3.4.7-cp38-cp38-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:16d971e29578a5e97d7117866d15889a4a07befe0e87e703ed63cd90cb348c01"}, {file = "charset_normalizer-3.4.7-cp38-cp38-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:dca4bbc466a95ba9c0234ef56d7dd9509f63da22274589ebd4ed7f1f4d4c54e3"}, {file = "charset_normalizer-3.4.7-cp38-cp38-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:e80c8378d8f3d83cd3164da1ad2df9e37a666cdde7b1cb2298ed0b558064be30"}, {file = "charset_normalizer-3.4.7-cp38-cp38-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:36836d6ff945a00b88ba1e4572d721e60b5b8c98c155d465f56ad19d68f23734"}, {file = "charset_normalizer-3.4.7-cp38-cp38-manylinux_2_31_armv7l.whl", hash = "sha256:bd9b23791fe793e4968dba0c447e12f78e425c59fc0e3b97f6450f4781f3ee60"}, {file = "charset_normalizer-3.4.7-cp38-cp38-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:aef65cd602a6d0e0ff6f9930fcb1c8fec60dd2cfcb6facaf4bdb0e5873042db0"}, {file = "charset_normalizer-3.4.7-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:82b271f5137d07749f7bf32f70b17ab6eaabedd297e75dce75081a24f76eb545"}, {file = "charset_normalizer-3.4.7-cp38-cp38-musllinux_1_2_armv7l.whl", hash = "sha256:1efde3cae86c8c273f1eb3b287be7d8499420cf2fe7585c41d370d3e790054a5"}, {file = "charset_normalizer-3.4.7-cp38-cp38-musllinux_1_2_ppc64le.whl", hash = "sha256:c593052c465475e64bbfe5dbd81680f64a67fdc752c56d7a0ae205dc8aeefe0f"}, {file = "charset_normalizer-3.4.7-cp38-cp38-musllinux_1_2_riscv64.whl", hash = "sha256:af21eb4409a119e365397b2adbaca4c9ccab56543a65d5dbd9f920d6ac29f686"}, {file = "charset_normalizer-3.4.7-cp38-cp38-musllinux_1_2_s390x.whl", hash = "sha256:84c018e49c3bf790f9c2771c45e9313a08c2c2a6342b162cd650258b57817706"}, {file = "charset_normalizer-3.4.7-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:dd915403e231e6b1809fe9b6d9fc55cf8fb5e02765ac625d9cd623342a7905d7"}, {file = "charset_normalizer-3.4.7-cp38-cp38-win32.whl", hash = "sha256:320ade88cfb846b8cd6b4ddf5ee9e80ee0c1f52401f2456b84ae1ae6a1a5f207"}, {file = "charset_normalizer-3.4.7-cp38-cp38-win_amd64.whl", hash = "sha256:1dc8b0ea451d6e69735094606991f32867807881400f808a106ee1d963c46a83"}, {file = "charset_normalizer-3.4.7-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:177a0ba5f0211d488e295aaf82707237e331c24788d8d76c96c5a41594723217"}, {file = "charset_normalizer-3.4.7-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6e0d51f618228538a3e8f46bd246f87a6cd030565e015803691603f55e12afb5"}, {file = "charset_normalizer-3.4.7-cp39-cp39-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:14265bfe1f09498b9d8ec91e9ec9fa52775edf90fcbde092b25f4a33d444fea9"}, {file = "charset_normalizer-3.4.7-cp39-cp39-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:87fad7d9ba98c86bcb41b2dc8dbb326619be2562af1f8ff50776a39e55721c5a"}, {file = "charset_normalizer-3.4.7-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f22dec1690b584cea26fade98b2435c132c1b5f68e39f5a0b7627cd7ae31f1dc"}, {file = "charset_normalizer-3.4.7-cp39-cp39-manylinux_2_31_armv7l.whl", hash = "sha256:d61f00a0869d77422d9b2aba989e2d24afa6ffd552af442e0e58de4f35ea6d00"}, {file = "charset_normalizer-3.4.7-cp39-cp39-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:6370e8686f662e6a3941ee48ed4742317cafbe5707e36406e9df792cdb535776"}, {file = "charset_normalizer-3.4.7-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:a6c5863edfbe888d9eff9c8b8087354e27618d9da76425c119293f11712a6319"}, {file = "charset_normalizer-3.4.7-cp39-cp39-musllinux_1_2_armv7l.whl", hash = "sha256:ed065083d0898c9d5b4bbec7b026fd755ff7454e6e8b73a67f8c744b13986e24"}, {file = "charset_normalizer-3.4.7-cp39-cp39-musllinux_1_2_ppc64le.whl", hash = "sha256:2cd4a60d0e2fb04537162c62bbbb4182f53541fe0ede35cdf270a1c1e723cc42"}, {file = "charset_normalizer-3.4.7-cp39-cp39-musllinux_1_2_riscv64.whl", hash = "sha256:813c0e0132266c08eb87469a642cb30aaff57c5f426255419572aaeceeaa7bf4"}, {file = "charset_normalizer-3.4.7-cp39-cp39-musllinux_1_2_s390x.whl", hash = "sha256:07d9e39b01743c3717745f4c530a6349eadbfa043c7577eef86c502c15df2c67"}, {file = "charset_normalizer-3.4.7-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:c0f081d69a6e58272819b70288d3221a6ee64b98df852631c80f293514d3b274"}, {file = "charset_normalizer-3.4.7-cp39-cp39-win32.whl", hash = "sha256:8751d2787c9131302398b11e6c8068053dcb55d5a8964e114b6e196cf16cb366"}, {file = "charset_normalizer-3.4.7-cp39-cp39-win_amd64.whl", hash = "sha256:12a6fff75f6bc66711b73a2f0addfc4c8c15a20e805146a02d147a318962c444"}, {file = "charset_normalizer-3.4.7-cp39-cp39-win_arm64.whl", hash = "sha256:bb8cc7534f51d9a017b93e3e85b260924f909601c3df002bcdb58ddb4dc41a5c"}, {file = "charset_normalizer-3.4.7-py3-none-any.whl", hash = "sha256:3dce51d0f5e7951f8bb4900c257dad282f49190fdbebecd4ba99bcc41fef404d"}, {file = "charset_normalizer-3.4.7.tar.gz", hash = "sha256:ae89db9e5f98a11a4bf50407d4363e7b09b31e55bc117b4f7d80aab97ba009e5"}, ] [[package]] name = "click" version = "8.3.2" description = "Composable command line interface toolkit" optional = false python-versions = ">=3.10" groups = ["main"] files = [ {file = "click-8.3.2-py3-none-any.whl", hash = "sha256:1924d2c27c5653561cd2cae4548d1406039cb79b858b747cfea24924bbc1616d"}, {file = "click-8.3.2.tar.gz", hash = "sha256:14162b8b3b3550a7d479eafa77dfd3c38d9dc8951f6f69c78913a8f9a7540fd5"}, ] [package.dependencies] colorama = {version = "*", markers = "platform_system == \"Windows\""} [[package]] name = "colorama" version = "0.4.6" description = "Cross-platform colored terminal text." optional = false python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7" groups = ["main", "dev"] files = [ {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"}, {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"}, ] markers = {dev = "sys_platform == \"win32\""} [[package]] name = "coverage" version = "7.13.5" description = "Code coverage measurement for Python" optional = false python-versions = ">=3.10" groups = ["dev"] files = [ {file = "coverage-7.13.5-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:e0723d2c96324561b9aa76fb982406e11d93cdb388a7a7da2b16e04719cf7ca5"}, {file = "coverage-7.13.5-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:52f444e86475992506b32d4e5ca55c24fc88d73bcbda0e9745095b28ef4dc0cf"}, {file = "coverage-7.13.5-cp310-cp310-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:704de6328e3d612a8f6c07000a878ff38181ec3263d5a11da1db294fa6a9bdf8"}, {file = "coverage-7.13.5-cp310-cp310-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:a1a6d79a14e1ec1832cabc833898636ad5f3754a678ef8bb4908515208bf84f4"}, {file = "coverage-7.13.5-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:79060214983769c7ba3f0cee10b54c97609dca4d478fa1aa32b914480fd5738d"}, {file = "coverage-7.13.5-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:356e76b46783a98c2a2fe81ec79df4883a1e62895ea952968fb253c114e7f930"}, {file = "coverage-7.13.5-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:0cef0cdec915d11254a7f549c1170afecce708d30610c6abdded1f74e581666d"}, {file = "coverage-7.13.5-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:dc022073d063b25a402454e5712ef9e007113e3a676b96c5f29b2bda29352f40"}, {file = "coverage-7.13.5-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:9b74db26dfea4f4e50d48a4602207cd1e78be33182bc9cbf22da94f332f99878"}, {file = "coverage-7.13.5-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:ad146744ca4fd09b50c482650e3c1b1f4dfa1d4792e0a04a369c7f23336f0400"}, {file = "coverage-7.13.5-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:c555b48be1853fe3997c11c4bd521cdd9a9612352de01fa4508f16ec341e6fe0"}, {file = "coverage-7.13.5-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:7034b5c56a58ae5e85f23949d52c14aca2cfc6848a31764995b7de88f13a1ea0"}, {file = "coverage-7.13.5-cp310-cp310-win32.whl", hash = "sha256:eb7fdf1ef130660e7415e0253a01a7d5a88c9c4d158bcf75cbbd922fd65a5b58"}, {file = "coverage-7.13.5-cp310-cp310-win_amd64.whl", hash = "sha256:3e1bb5f6c78feeb1be3475789b14a0f0a5b47d505bfc7267126ccbd50289999e"}, {file = "coverage-7.13.5-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:66a80c616f80181f4d643b0f9e709d97bcea413ecd9631e1dedc7401c8e6695d"}, {file = "coverage-7.13.5-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:145ede53ccbafb297c1c9287f788d1bc3efd6c900da23bf6931b09eafc931587"}, {file = "coverage-7.13.5-cp311-cp311-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:0672854dc733c342fa3e957e0605256d2bf5934feeac328da9e0b5449634a642"}, {file = "coverage-7.13.5-cp311-cp311-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:ec10e2a42b41c923c2209b846126c6582db5e43a33157e9870ba9fb70dc7854b"}, {file = "coverage-7.13.5-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:be3d4bbad9d4b037791794ddeedd7d64a56f5933a2c1373e18e9e568b9141686"}, {file = "coverage-7.13.5-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:4d2afbc5cc54d286bfb54541aa50b64cdb07a718227168c87b9e2fb8f25e1743"}, {file = "coverage-7.13.5-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:3ad050321264c49c2fa67bb599100456fc51d004b82534f379d16445da40fb75"}, {file = "coverage-7.13.5-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:7300c8a6d13335b29bb76d7651c66af6bd8658517c43499f110ddc6717bfc209"}, {file = "coverage-7.13.5-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:eb07647a5738b89baab047f14edd18ded523de60f3b30e75c2acc826f79c839a"}, {file = "coverage-7.13.5-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:9adb6688e3b53adffefd4a52d72cbd8b02602bfb8f74dcd862337182fd4d1a4e"}, {file = "coverage-7.13.5-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:7c8d4bc913dd70b93488d6c496c77f3aff5ea99a07e36a18f865bca55adef8bd"}, {file = "coverage-7.13.5-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:0e3c426ffc4cd952f54ee9ffbdd10345709ecc78a3ecfd796a57236bfad0b9b8"}, {file = "coverage-7.13.5-cp311-cp311-win32.whl", hash = "sha256:259b69bb83ad9894c4b25be2528139eecba9a82646ebdda2d9db1ba28424a6bf"}, {file = "coverage-7.13.5-cp311-cp311-win_amd64.whl", hash = "sha256:258354455f4e86e3e9d0d17571d522e13b4e1e19bf0f8596bcf9476d61e7d8a9"}, {file = "coverage-7.13.5-cp311-cp311-win_arm64.whl", hash = "sha256:bff95879c33ec8da99fc9b6fe345ddb5be6414b41d6d1ad1c8f188d26f36e028"}, {file = "coverage-7.13.5-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:460cf0114c5016fa841214ff5564aa4864f11948da9440bc97e21ad1f4ba1e01"}, {file = "coverage-7.13.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:0e223ce4b4ed47f065bfb123687686512e37629be25cc63728557ae7db261422"}, {file = "coverage-7.13.5-cp312-cp312-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:6e3370441f4513c6252bf042b9c36d22491142385049243253c7e48398a15a9f"}, {file = "coverage-7.13.5-cp312-cp312-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:03ccc709a17a1de074fb1d11f217342fb0d2b1582ed544f554fc9fc3f07e95f5"}, {file = "coverage-7.13.5-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3f4818d065964db3c1c66dc0fbdac5ac692ecbc875555e13374fdbe7eedb4376"}, {file = "coverage-7.13.5-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:012d5319e66e9d5a218834642d6c35d265515a62f01157a45bcc036ecf947256"}, {file = "coverage-7.13.5-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:8dd02af98971bdb956363e4827d34425cb3df19ee550ef92855b0acb9c7ce51c"}, {file = "coverage-7.13.5-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:f08fd75c50a760c7eb068ae823777268daaf16a80b918fa58eea888f8e3919f5"}, {file = "coverage-7.13.5-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:843ea8643cf967d1ac7e8ecd4bb00c99135adf4816c0c0593fdcc47b597fcf09"}, {file = "coverage-7.13.5-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:9d44d7aa963820b1b971dbecd90bfe5fe8f81cff79787eb6cca15750bd2f79b9"}, {file = "coverage-7.13.5-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:7132bed4bd7b836200c591410ae7d97bf7ae8be6fc87d160b2bd881df929e7bf"}, {file = "coverage-7.13.5-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:a698e363641b98843c517817db75373c83254781426e94ada3197cabbc2c919c"}, {file = "coverage-7.13.5-cp312-cp312-win32.whl", hash = "sha256:bdba0a6b8812e8c7df002d908a9a2ea3c36e92611b5708633c50869e6d922fdf"}, {file = "coverage-7.13.5-cp312-cp312-win_amd64.whl", hash = "sha256:d2c87e0c473a10bffe991502eac389220533024c8082ec1ce849f4218dded810"}, {file = "coverage-7.13.5-cp312-cp312-win_arm64.whl", hash = "sha256:bf69236a9a81bdca3bff53796237aab096cdbf8d78a66ad61e992d9dac7eb2de"}, {file = "coverage-7.13.5-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:5ec4af212df513e399cf11610cc27063f1586419e814755ab362e50a85ea69c1"}, {file = "coverage-7.13.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:941617e518602e2d64942c88ec8499f7fbd49d3f6c4327d3a71d43a1973032f3"}, {file = "coverage-7.13.5-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:da305e9937617ee95c2e39d8ff9f040e0487cbf1ac174f777ed5eddd7a7c1f26"}, {file = "coverage-7.13.5-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:78e696e1cc714e57e8b25760b33a8b1026b7048d270140d25dafe1b0a1ee05a3"}, {file = "coverage-7.13.5-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:02ca0eed225b2ff301c474aeeeae27d26e2537942aa0f87491d3e147e784a82b"}, {file = "coverage-7.13.5-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:04690832cbea4e4663d9149e05dba142546ca05cb1848816760e7f58285c970a"}, {file = "coverage-7.13.5-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:0590e44dd2745c696a778f7bab6aa95256de2cbc8b8cff4f7db8ff09813d6969"}, {file = "coverage-7.13.5-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d7cfad2d6d81dd298ab6b89fe72c3b7b05ec7544bdda3b707ddaecff8d25c161"}, {file = "coverage-7.13.5-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:e092b9499de38ae0fbfbc603a74660eb6ff3e869e507b50d85a13b6db9863e15"}, {file = "coverage-7.13.5-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:48c39bc4a04d983a54a705a6389512883d4a3b9862991b3617d547940e9f52b1"}, {file = "coverage-7.13.5-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:2d3807015f138ffea1ed9afeeb8624fd781703f2858b62a8dd8da5a0994c57b6"}, {file = "coverage-7.13.5-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:ee2aa19e03161671ec964004fb74b2257805d9710bf14a5c704558b9d8dbaf17"}, {file = "coverage-7.13.5-cp313-cp313-win32.whl", hash = "sha256:ce1998c0483007608c8382f4ff50164bfc5bd07a2246dd272aa4043b75e61e85"}, {file = "coverage-7.13.5-cp313-cp313-win_amd64.whl", hash = "sha256:631efb83f01569670a5e866ceb80fe483e7c159fac6f167e6571522636104a0b"}, {file = "coverage-7.13.5-cp313-cp313-win_arm64.whl", hash = "sha256:f4cd16206ad171cbc2470dbea9103cf9a7607d5fe8c242fdf1edf36174020664"}, {file = "coverage-7.13.5-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:0428cbef5783ad91fe240f673cc1f76b25e74bbfe1a13115e4aa30d3f538162d"}, {file = "coverage-7.13.5-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:e0b216a19534b2427cc201a26c25da4a48633f29a487c61258643e89d28200c0"}, {file = "coverage-7.13.5-cp313-cp313t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:972a9cd27894afe4bc2b1480107054e062df08e671df7c2f18c205e805ccd806"}, {file = "coverage-7.13.5-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:4b59148601efcd2bac8c4dbf1f0ad6391693ccf7a74b8205781751637076aee3"}, {file = "coverage-7.13.5-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:505d7083c8b0c87a8fa8c07370c285847c1f77739b22e299ad75a6af6c32c5c9"}, {file = "coverage-7.13.5-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:60365289c3741e4db327e7baff2a4aaacf22f788e80fa4683393891b70a89fbd"}, {file = "coverage-7.13.5-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:1b88c69c8ef5d4b6fe7dea66d6636056a0f6a7527c440e890cf9259011f5e606"}, {file = "coverage-7.13.5-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:5b13955d31d1633cf9376908089b7cebe7d15ddad7aeaabcbe969a595a97e95e"}, {file = "coverage-7.13.5-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:f70c9ab2595c56f81a89620e22899eea8b212a4041bd728ac6f4a28bf5d3ddd0"}, {file = "coverage-7.13.5-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:084b84a8c63e8d6fc7e3931b316a9bcafca1458d753c539db82d31ed20091a87"}, {file = "coverage-7.13.5-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:ad14385487393e386e2ea988b09d62dd42c397662ac2dabc3832d71253eee479"}, {file = "coverage-7.13.5-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:7f2c47b36fe7709a6e83bfadf4eefb90bd25fbe4014d715224c4316f808e59a2"}, {file = "coverage-7.13.5-cp313-cp313t-win32.whl", hash = "sha256:67e9bc5449801fad0e5dff329499fb090ba4c5800b86805c80617b4e29809b2a"}, {file = "coverage-7.13.5-cp313-cp313t-win_amd64.whl", hash = "sha256:da86cdcf10d2519e10cabb8ac2de03da1bcb6e4853790b7fbd48523332e3a819"}, {file = "coverage-7.13.5-cp313-cp313t-win_arm64.whl", hash = "sha256:0ecf12ecb326fe2c339d93fc131816f3a7367d223db37817208905c89bded911"}, {file = "coverage-7.13.5-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:fbabfaceaeb587e16f7008f7795cd80d20ec548dc7f94fbb0d4ec2e038ce563f"}, {file = "coverage-7.13.5-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:9bb2a28101a443669a423b665939381084412b81c3f8c0fcfbac57f4e30b5b8e"}, {file = "coverage-7.13.5-cp314-cp314-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:bd3a2fbc1c6cccb3c5106140d87cc6a8715110373ef42b63cf5aea29df8c217a"}, {file = "coverage-7.13.5-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:6c36ddb64ed9d7e496028d1d00dfec3e428e0aabf4006583bb1839958d280510"}, {file = "coverage-7.13.5-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:380e8e9084d8eb38db3a9176a1a4f3c0082c3806fa0dc882d1d87abc3c789247"}, {file = "coverage-7.13.5-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:e808af52a0513762df4d945ea164a24b37f2f518cbe97e03deaa0ee66139b4d6"}, {file = "coverage-7.13.5-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:e301d30dd7e95ae068671d746ba8c34e945a82682e62918e41b2679acd2051a0"}, {file = "coverage-7.13.5-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:800bc829053c80d240a687ceeb927a94fd108bbdc68dfbe505d0d75ab578a882"}, {file = "coverage-7.13.5-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:0b67af5492adb31940ee418a5a655c28e48165da5afab8c7fa6fd72a142f8740"}, {file = "coverage-7.13.5-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:c9136ff29c3a91e25b1d1552b5308e53a1e0653a23e53b6366d7c2dcbbaf8a16"}, {file = "coverage-7.13.5-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:cff784eef7f0b8f6cb28804fbddcfa99f89efe4cc35fb5627e3ac58f91ed3ac0"}, {file = "coverage-7.13.5-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:68a4953be99b17ac3c23b6efbc8a38330d99680c9458927491d18700ef23ded0"}, {file = "coverage-7.13.5-cp314-cp314-win32.whl", hash = "sha256:35a31f2b1578185fbe6aa2e74cea1b1d0bbf4c552774247d9160d29b80ed56cc"}, {file = "coverage-7.13.5-cp314-cp314-win_amd64.whl", hash = "sha256:2aa055ae1857258f9e0045be26a6d62bdb47a72448b62d7b55f4820f361a2633"}, {file = "coverage-7.13.5-cp314-cp314-win_arm64.whl", hash = "sha256:1b11eef33edeae9d142f9b4358edb76273b3bfd30bc3df9a4f95d0e49caf94e8"}, {file = "coverage-7.13.5-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:10a0c37f0b646eaff7cce1874c31d1f1ccb297688d4c747291f4f4c70741cc8b"}, {file = "coverage-7.13.5-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:b5db73ba3c41c7008037fa731ad5459fc3944cb7452fc0aa9f822ad3533c583c"}, {file = "coverage-7.13.5-cp314-cp314t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:750db93a81e3e5a9831b534be7b1229df848b2e125a604fe6651e48aa070e5f9"}, {file = "coverage-7.13.5-cp314-cp314t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:9ddb4f4a5479f2539644be484da179b653273bca1a323947d48ab107b3ed1f29"}, {file = "coverage-7.13.5-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d8a7a2049c14f413163e2bdabd37e41179b1d1ccb10ffc6ccc4b7a718429c607"}, {file = "coverage-7.13.5-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:e1c85e0b6c05c592ea6d8768a66a254bfb3874b53774b12d4c89c481eb78cb90"}, {file = "coverage-7.13.5-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:777c4d1eff1b67876139d24288aaf1817f6c03d6bae9c5cc8d27b83bcfe38fe3"}, {file = "coverage-7.13.5-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:6697e29b93707167687543480a40f0db8f356e86d9f67ddf2e37e2dfd91a9dab"}, {file = "coverage-7.13.5-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:8fdf453a942c3e4d99bd80088141c4c6960bb232c409d9c3558e2dbaa3998562"}, {file = "coverage-7.13.5-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:32ca0c0114c9834a43f045a87dcebd69d108d8ffb666957ea65aa132f50332e2"}, {file = "coverage-7.13.5-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:8769751c10f339021e2638cd354e13adeac54004d1941119b2c96fe5276d45ea"}, {file = "coverage-7.13.5-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:cec2d83125531bd153175354055cdb7a09987af08a9430bd173c937c6d0fba2a"}, {file = "coverage-7.13.5-cp314-cp314t-win32.whl", hash = "sha256:0cd9ed7a8b181775459296e402ca4fb27db1279740a24e93b3b41942ebe4b215"}, {file = "coverage-7.13.5-cp314-cp314t-win_amd64.whl", hash = "sha256:301e3b7dfefecaca37c9f1aa6f0049b7d4ab8dd933742b607765d757aca77d43"}, {file = "coverage-7.13.5-cp314-cp314t-win_arm64.whl", hash = "sha256:9dacc2ad679b292709e0f5fc1ac74a6d4d5562e424058962c7bb0c658ad25e45"}, {file = "coverage-7.13.5-py3-none-any.whl", hash = "sha256:34b02417cf070e173989b3db962f7ed56d2f644307b2cf9d5a0f258e13084a61"}, {file = "coverage-7.13.5.tar.gz", hash = "sha256:c81f6515c4c40141f83f502b07bbfa5c240ba25bbe73da7b33f1e5b6120ff179"}, ] [package.dependencies] tomli = {version = "*", optional = true, markers = "python_full_version <= \"3.11.0a6\" and extra == \"toml\""} [package.extras] toml = ["tomli ; python_full_version <= \"3.11.0a6\""] [[package]] name = "defusedxml" version = "0.7.1" description = "XML bomb protection for Python stdlib modules" optional = false python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*" groups = ["dev"] files = [ {file = "defusedxml-0.7.1-py2.py3-none-any.whl", hash = "sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61"}, {file = "defusedxml-0.7.1.tar.gz", hash = "sha256:1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69"}, ] [[package]] name = "diskcache" version = "5.6.3" description = "Disk Cache -- Disk and file backed persistent cache." optional = false python-versions = ">=3" groups = ["main"] files = [ {file = "diskcache-5.6.3-py3-none-any.whl", hash = "sha256:5e31b2d5fbad117cc363ebaf6b689474db18a1f6438bc82358b024abd4c2ca19"}, {file = "diskcache-5.6.3.tar.gz", hash = "sha256:2c3a3fa2743d8535d832ec61c2054a1641f41775aa7c556758a109941e33e4fc"}, ] [[package]] name = "diskcache-stubs" version = "5.6.3.6.20240818" description = "diskcache stubs" optional = false python-versions = ">=3" groups = ["main"] files = [ {file = "diskcache_stubs-5.6.3.6.20240818-py3-none-any.whl", hash = "sha256:e1db90940b344140730976abe79f57f5b43ca296cbb43fa95da0c69b12d5de4f"}, {file = "diskcache_stubs-5.6.3.6.20240818.tar.gz", hash = "sha256:b6eb43899e906b3167a20ac09a9a226f30267a306a96542ea720ebbfc3282796"}, ] [package.dependencies] typing-extensions = ">=4.4.0" [[package]] name = "exceptiongroup" version = "1.3.1" description = "Backport of PEP 654 (exception groups)" optional = false python-versions = ">=3.7" groups = ["dev"] markers = "python_version == \"3.10\"" files = [ {file = "exceptiongroup-1.3.1-py3-none-any.whl", hash = "sha256:a7a39a3bd276781e98394987d3a5701d0c4edffb633bb7a5144577f82c773598"}, {file = "exceptiongroup-1.3.1.tar.gz", hash = "sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219"}, ] [package.dependencies] typing-extensions = {version = ">=4.6.0", markers = "python_version < \"3.13\""} [package.extras] test = ["pytest (>=6)"] [[package]] name = "idna" version = "3.11" description = "Internationalized Domain Names in Applications (IDNA)" optional = false python-versions = ">=3.8" groups = ["main"] files = [ {file = "idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea"}, {file = "idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902"}, ] [package.extras] all = ["flake8 (>=7.1.1)", "mypy (>=1.11.2)", "pytest (>=8.3.2)", "ruff (>=0.6.2)"] [[package]] name = "iniconfig" version = "2.3.0" description = "brain-dead simple config-ini parsing" optional = false python-versions = ">=3.10" groups = ["dev"] files = [ {file = "iniconfig-2.3.0-py3-none-any.whl", hash = "sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12"}, {file = "iniconfig-2.3.0.tar.gz", hash = "sha256:c76315c77db068650d49c5b56314774a7804df16fee4402c1f19d6d15d8c4730"}, ] [[package]] name = "jinja2" version = "3.1.6" description = "A very fast and expressive template engine." optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "jinja2-3.1.6-py3-none-any.whl", hash = "sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67"}, {file = "jinja2-3.1.6.tar.gz", hash = "sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d"}, ] [package.dependencies] MarkupSafe = ">=2.0" [package.extras] i18n = ["Babel (>=2.7)"] [[package]] name = "markupsafe" version = "3.0.3" description = "Safely add untrusted strings to HTML/XML markup." optional = false python-versions = ">=3.9" groups = ["main"] files = [ {file = "markupsafe-3.0.3-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:2f981d352f04553a7171b8e44369f2af4055f888dfb147d55e42d29e29e74559"}, {file = "markupsafe-3.0.3-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:e1c1493fb6e50ab01d20a22826e57520f1284df32f2d8601fdd90b6304601419"}, {file = "markupsafe-3.0.3-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1ba88449deb3de88bd40044603fafffb7bc2b055d626a330323a9ed736661695"}, {file = "markupsafe-3.0.3-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f42d0984e947b8adf7dd6dde396e720934d12c506ce84eea8476409563607591"}, {file = "markupsafe-3.0.3-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:c0c0b3ade1c0b13b936d7970b1d37a57acde9199dc2aecc4c336773e1d86049c"}, {file = "markupsafe-3.0.3-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:0303439a41979d9e74d18ff5e2dd8c43ed6c6001fd40e5bf2e43f7bd9bbc523f"}, {file = "markupsafe-3.0.3-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:d2ee202e79d8ed691ceebae8e0486bd9a2cd4794cec4824e1c99b6f5009502f6"}, {file = "markupsafe-3.0.3-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:177b5253b2834fe3678cb4a5f0059808258584c559193998be2601324fdeafb1"}, {file = "markupsafe-3.0.3-cp310-cp310-win32.whl", hash = "sha256:2a15a08b17dd94c53a1da0438822d70ebcd13f8c3a95abe3a9ef9f11a94830aa"}, {file = "markupsafe-3.0.3-cp310-cp310-win_amd64.whl", hash = "sha256:c4ffb7ebf07cfe8931028e3e4c85f0357459a3f9f9490886198848f4fa002ec8"}, {file = "markupsafe-3.0.3-cp310-cp310-win_arm64.whl", hash = "sha256:e2103a929dfa2fcaf9bb4e7c091983a49c9ac3b19c9061b6d5427dd7d14d81a1"}, {file = "markupsafe-3.0.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:1cc7ea17a6824959616c525620e387f6dd30fec8cb44f649e31712db02123dad"}, {file = "markupsafe-3.0.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:4bd4cd07944443f5a265608cc6aab442e4f74dff8088b0dfc8238647b8f6ae9a"}, {file = "markupsafe-3.0.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6b5420a1d9450023228968e7e6a9ce57f65d148ab56d2313fcd589eee96a7a50"}, {file = "markupsafe-3.0.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0bf2a864d67e76e5c9a34dc26ec616a66b9888e25e7b9460e1c76d3293bd9dbf"}, {file = "markupsafe-3.0.3-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:bc51efed119bc9cfdf792cdeaa4d67e8f6fcccab66ed4bfdd6bde3e59bfcbb2f"}, {file = "markupsafe-3.0.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:068f375c472b3e7acbe2d5318dea141359e6900156b5b2ba06a30b169086b91a"}, {file = "markupsafe-3.0.3-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:7be7b61bb172e1ed687f1754f8e7484f1c8019780f6f6b0786e76bb01c2ae115"}, {file = "markupsafe-3.0.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:f9e130248f4462aaa8e2552d547f36ddadbeaa573879158d721bbd33dfe4743a"}, {file = "markupsafe-3.0.3-cp311-cp311-win32.whl", hash = "sha256:0db14f5dafddbb6d9208827849fad01f1a2609380add406671a26386cdf15a19"}, {file = "markupsafe-3.0.3-cp311-cp311-win_amd64.whl", hash = "sha256:de8a88e63464af587c950061a5e6a67d3632e36df62b986892331d4620a35c01"}, {file = "markupsafe-3.0.3-cp311-cp311-win_arm64.whl", hash = "sha256:3b562dd9e9ea93f13d53989d23a7e775fdfd1066c33494ff43f5418bc8c58a5c"}, {file = "markupsafe-3.0.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:d53197da72cc091b024dd97249dfc7794d6a56530370992a5e1a08983ad9230e"}, {file = "markupsafe-3.0.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:1872df69a4de6aead3491198eaf13810b565bdbeec3ae2dc8780f14458ec73ce"}, {file = "markupsafe-3.0.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3a7e8ae81ae39e62a41ec302f972ba6ae23a5c5396c8e60113e9066ef893da0d"}, {file = "markupsafe-3.0.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:d6dd0be5b5b189d31db7cda48b91d7e0a9795f31430b7f271219ab30f1d3ac9d"}, {file = "markupsafe-3.0.3-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:94c6f0bb423f739146aec64595853541634bde58b2135f27f61c1ffd1cd4d16a"}, {file = "markupsafe-3.0.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:be8813b57049a7dc738189df53d69395eba14fb99345e0a5994914a3864c8a4b"}, {file = "markupsafe-3.0.3-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:83891d0e9fb81a825d9a6d61e3f07550ca70a076484292a70fde82c4b807286f"}, {file = "markupsafe-3.0.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:77f0643abe7495da77fb436f50f8dab76dbc6e5fd25d39589a0f1fe6548bfa2b"}, {file = "markupsafe-3.0.3-cp312-cp312-win32.whl", hash = "sha256:d88b440e37a16e651bda4c7c2b930eb586fd15ca7406cb39e211fcff3bf3017d"}, {file = "markupsafe-3.0.3-cp312-cp312-win_amd64.whl", hash = "sha256:26a5784ded40c9e318cfc2bdb30fe164bdb8665ded9cd64d500a34fb42067b1c"}, {file = "markupsafe-3.0.3-cp312-cp312-win_arm64.whl", hash = "sha256:35add3b638a5d900e807944a078b51922212fb3dedb01633a8defc4b01a3c85f"}, {file = "markupsafe-3.0.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:e1cf1972137e83c5d4c136c43ced9ac51d0e124706ee1c8aa8532c1287fa8795"}, {file = "markupsafe-3.0.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:116bb52f642a37c115f517494ea5feb03889e04df47eeff5b130b1808ce7c219"}, {file = "markupsafe-3.0.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:133a43e73a802c5562be9bbcd03d090aa5a1fe899db609c29e8c8d815c5f6de6"}, {file = "markupsafe-3.0.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ccfcd093f13f0f0b7fdd0f198b90053bf7b2f02a3927a30e63f3ccc9df56b676"}, {file = "markupsafe-3.0.3-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:509fa21c6deb7a7a273d629cf5ec029bc209d1a51178615ddf718f5918992ab9"}, {file = "markupsafe-3.0.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a4afe79fb3de0b7097d81da19090f4df4f8d3a2b3adaa8764138aac2e44f3af1"}, {file = "markupsafe-3.0.3-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:795e7751525cae078558e679d646ae45574b47ed6e7771863fcc079a6171a0fc"}, {file = "markupsafe-3.0.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:8485f406a96febb5140bfeca44a73e3ce5116b2501ac54fe953e488fb1d03b12"}, {file = "markupsafe-3.0.3-cp313-cp313-win32.whl", hash = "sha256:bdd37121970bfd8be76c5fb069c7751683bdf373db1ed6c010162b2a130248ed"}, {file = "markupsafe-3.0.3-cp313-cp313-win_amd64.whl", hash = "sha256:9a1abfdc021a164803f4d485104931fb8f8c1efd55bc6b748d2f5774e78b62c5"}, {file = "markupsafe-3.0.3-cp313-cp313-win_arm64.whl", hash = "sha256:7e68f88e5b8799aa49c85cd116c932a1ac15caaa3f5db09087854d218359e485"}, {file = "markupsafe-3.0.3-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:218551f6df4868a8d527e3062d0fb968682fe92054e89978594c28e642c43a73"}, {file = "markupsafe-3.0.3-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:3524b778fe5cfb3452a09d31e7b5adefeea8c5be1d43c4f810ba09f2ceb29d37"}, {file = "markupsafe-3.0.3-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4e885a3d1efa2eadc93c894a21770e4bc67899e3543680313b09f139e149ab19"}, {file = "markupsafe-3.0.3-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8709b08f4a89aa7586de0aadc8da56180242ee0ada3999749b183aa23df95025"}, {file = "markupsafe-3.0.3-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b8512a91625c9b3da6f127803b166b629725e68af71f8184ae7e7d54686a56d6"}, {file = "markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:9b79b7a16f7fedff2495d684f2b59b0457c3b493778c9eed31111be64d58279f"}, {file = "markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:12c63dfb4a98206f045aa9563db46507995f7ef6d83b2f68eda65c307c6829eb"}, {file = "markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:8f71bc33915be5186016f675cd83a1e08523649b0e33efdb898db577ef5bb009"}, {file = "markupsafe-3.0.3-cp313-cp313t-win32.whl", hash = "sha256:69c0b73548bc525c8cb9a251cddf1931d1db4d2258e9599c28c07ef3580ef354"}, {file = "markupsafe-3.0.3-cp313-cp313t-win_amd64.whl", hash = "sha256:1b4b79e8ebf6b55351f0d91fe80f893b4743f104bff22e90697db1590e47a218"}, {file = "markupsafe-3.0.3-cp313-cp313t-win_arm64.whl", hash = "sha256:ad2cf8aa28b8c020ab2fc8287b0f823d0a7d8630784c31e9ee5edea20f406287"}, {file = "markupsafe-3.0.3-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:eaa9599de571d72e2daf60164784109f19978b327a3910d3e9de8c97b5b70cfe"}, {file = "markupsafe-3.0.3-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c47a551199eb8eb2121d4f0f15ae0f923d31350ab9280078d1e5f12b249e0026"}, {file = "markupsafe-3.0.3-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f34c41761022dd093b4b6896d4810782ffbabe30f2d443ff5f083e0cbbb8c737"}, {file = "markupsafe-3.0.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:457a69a9577064c05a97c41f4e65148652db078a3a509039e64d3467b9e7ef97"}, {file = "markupsafe-3.0.3-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:e8afc3f2ccfa24215f8cb28dcf43f0113ac3c37c2f0f0806d8c70e4228c5cf4d"}, {file = "markupsafe-3.0.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:ec15a59cf5af7be74194f7ab02d0f59a62bdcf1a537677ce67a2537c9b87fcda"}, {file = "markupsafe-3.0.3-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:0eb9ff8191e8498cca014656ae6b8d61f39da5f95b488805da4bb029cccbfbaf"}, {file = "markupsafe-3.0.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:2713baf880df847f2bece4230d4d094280f4e67b1e813eec43b4c0e144a34ffe"}, {file = "markupsafe-3.0.3-cp314-cp314-win32.whl", hash = "sha256:729586769a26dbceff69f7a7dbbf59ab6572b99d94576a5592625d5b411576b9"}, {file = "markupsafe-3.0.3-cp314-cp314-win_amd64.whl", hash = "sha256:bdc919ead48f234740ad807933cdf545180bfbe9342c2bb451556db2ed958581"}, {file = "markupsafe-3.0.3-cp314-cp314-win_arm64.whl", hash = "sha256:5a7d5dc5140555cf21a6fefbdbf8723f06fcd2f63ef108f2854de715e4422cb4"}, {file = "markupsafe-3.0.3-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:1353ef0c1b138e1907ae78e2f6c63ff67501122006b0f9abad68fda5f4ffc6ab"}, {file = "markupsafe-3.0.3-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:1085e7fbddd3be5f89cc898938f42c0b3c711fdcb37d75221de2666af647c175"}, {file = "markupsafe-3.0.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1b52b4fb9df4eb9ae465f8d0c228a00624de2334f216f178a995ccdcf82c4634"}, {file = "markupsafe-3.0.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:fed51ac40f757d41b7c48425901843666a6677e3e8eb0abcff09e4ba6e664f50"}, {file = "markupsafe-3.0.3-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f190daf01f13c72eac4efd5c430a8de82489d9cff23c364c3ea822545032993e"}, {file = "markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e56b7d45a839a697b5eb268c82a71bd8c7f6c94d6fd50c3d577fa39a9f1409f5"}, {file = "markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:f3e98bb3798ead92273dc0e5fd0f31ade220f59a266ffd8a4f6065e0a3ce0523"}, {file = "markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:5678211cb9333a6468fb8d8be0305520aa073f50d17f089b5b4b477ea6e67fdc"}, {file = "markupsafe-3.0.3-cp314-cp314t-win32.whl", hash = "sha256:915c04ba3851909ce68ccc2b8e2cd691618c4dc4c4232fb7982bca3f41fd8c3d"}, {file = "markupsafe-3.0.3-cp314-cp314t-win_amd64.whl", hash = "sha256:4faffd047e07c38848ce017e8725090413cd80cbc23d86e55c587bf979e579c9"}, {file = "markupsafe-3.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:32001d6a8fc98c8cb5c947787c5d08b0a50663d139f1305bac5885d98d9b40fa"}, {file = "markupsafe-3.0.3-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:15d939a21d546304880945ca1ecb8a039db6b4dc49b2c5a400387cdae6a62e26"}, {file = "markupsafe-3.0.3-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:f71a396b3bf33ecaa1626c255855702aca4d3d9fea5e051b41ac59a9c1c41edc"}, {file = "markupsafe-3.0.3-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0f4b68347f8c5eab4a13419215bdfd7f8c9b19f2b25520968adfad23eb0ce60c"}, {file = "markupsafe-3.0.3-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e8fc20152abba6b83724d7ff268c249fa196d8259ff481f3b1476383f8f24e42"}, {file = "markupsafe-3.0.3-cp39-cp39-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:949b8d66bc381ee8b007cd945914c721d9aba8e27f71959d750a46f7c282b20b"}, {file = "markupsafe-3.0.3-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:3537e01efc9d4dccdf77221fb1cb3b8e1a38d5428920e0657ce299b20324d758"}, {file = "markupsafe-3.0.3-cp39-cp39-musllinux_1_2_riscv64.whl", hash = "sha256:591ae9f2a647529ca990bc681daebdd52c8791ff06c2bfa05b65163e28102ef2"}, {file = "markupsafe-3.0.3-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:a320721ab5a1aba0a233739394eb907f8c8da5c98c9181d1161e77a0c8e36f2d"}, {file = "markupsafe-3.0.3-cp39-cp39-win32.whl", hash = "sha256:df2449253ef108a379b8b5d6b43f4b1a8e81a061d6537becd5582fba5f9196d7"}, {file = "markupsafe-3.0.3-cp39-cp39-win_amd64.whl", hash = "sha256:7c3fb7d25180895632e5d3148dbdc29ea38ccb7fd210aa27acbd1201a1902c6e"}, {file = "markupsafe-3.0.3-cp39-cp39-win_arm64.whl", hash = "sha256:38664109c14ffc9e7437e86b4dceb442b0096dfe3541d7864d9cbe1da4cf36c8"}, {file = "markupsafe-3.0.3.tar.gz", hash = "sha256:722695808f4b6457b320fdc131280796bdceb04ab50fe1795cd540799ebe1698"}, ] [[package]] name = "packaging" version = "26.0" description = "Core utilities for Python packages" optional = false python-versions = ">=3.8" groups = ["main", "dev"] files = [ {file = "packaging-26.0-py3-none-any.whl", hash = "sha256:b36f1fef9334a5588b4166f8bcd26a14e521f2b55e6b9de3aaa80d3ff7a37529"}, {file = "packaging-26.0.tar.gz", hash = "sha256:00243ae351a257117b6a241061796684b084ed1c516a08c48a3f7e147a9d80b4"}, ] [[package]] name = "pluggy" version = "1.6.0" description = "plugin and hook calling mechanisms for python" optional = false python-versions = ">=3.9" groups = ["dev"] files = [ {file = "pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746"}, {file = "pluggy-1.6.0.tar.gz", hash = "sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3"}, ] [package.extras] dev = ["pre-commit", "tox"] testing = ["coverage", "pytest", "pytest-benchmark"] [[package]] name = "prettytable" version = "3.17.0" description = "A simple Python library for easily displaying tabular data in a visually appealing ASCII table format" optional = false python-versions = ">=3.10" groups = ["main"] files = [ {file = "prettytable-3.17.0-py3-none-any.whl", hash = "sha256:aad69b294ddbe3e1f95ef8886a060ed1666a0b83018bbf56295f6f226c43d287"}, {file = "prettytable-3.17.0.tar.gz", hash = "sha256:59f2590776527f3c9e8cf9fe7b66dd215837cca96a9c39567414cbc632e8ddb0"}, ] [package.dependencies] wcwidth = "*" [package.extras] tests = ["pytest", "pytest-cov", "pytest-lazy-fixtures"] [[package]] name = "pygments" version = "2.20.0" description = "Pygments is a syntax highlighting package written in Python." optional = false python-versions = ">=3.9" groups = ["dev"] files = [ {file = "pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176"}, {file = "pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f"}, ] [package.extras] windows-terminal = ["colorama (>=0.4.6)"] [[package]] name = "pyparsing" version = "3.3.2" description = "pyparsing - Classes and methods to define and execute parsing grammars" optional = false python-versions = ">=3.9" groups = ["main"] files = [ {file = "pyparsing-3.3.2-py3-none-any.whl", hash = "sha256:850ba148bd908d7e2411587e247a1e4f0327839c40e2e5e6d05a007ecc69911d"}, {file = "pyparsing-3.3.2.tar.gz", hash = "sha256:c777f4d763f140633dcb6d8a3eda953bf7a214dc4eff598413c070bcdc117cbc"}, ] [package.extras] diagrams = ["jinja2", "railroad-diagrams"] [[package]] name = "pysigma" version = "1.3.1" description = "Sigma rule processing and conversion tools" optional = false python-versions = "<4.0,>=3.10" groups = ["main"] files = [ {file = "pysigma-1.3.1-py3-none-any.whl", hash = "sha256:89f601a31c4f9f520117f16ba3542c704d91eb217154e9a8a715d35c0ead8688"}, {file = "pysigma-1.3.1.tar.gz", hash = "sha256:a67286cfb4aa915c08f2639922d1b5d28a73ef6aefe01e60fda9430f38d77966"}, ] [package.dependencies] diskcache = ">=5.6.3,<6.0.0" diskcache-stubs = ">=5.6.3.6.20240818,<6.0.0.0.0" jinja2 = ">=3.1.6,<4.0.0" packaging = ">=26.0,<27.0" pyparsing = ">=3.2.5,<4.0.0" pyyaml = ">=6.0.3,<7.0.0" requests = ">=2.32.5,<3.0.0" types-pyyaml = ">=6.0.12.20250915,<7.0.0.0" typing-extensions = ">=4.15.0,<5.0.0" [[package]] name = "pytest" version = "9.0.3" description = "pytest: simple powerful testing with Python" optional = false python-versions = ">=3.10" groups = ["dev"] files = [ {file = "pytest-9.0.3-py3-none-any.whl", hash = "sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9"}, {file = "pytest-9.0.3.tar.gz", hash = "sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c"}, ] [package.dependencies] colorama = {version = ">=0.4", markers = "sys_platform == \"win32\""} exceptiongroup = {version = ">=1", markers = "python_version < \"3.11\""} iniconfig = ">=1.0.1" packaging = ">=22" pluggy = ">=1.5,<2" pygments = ">=2.7.2" tomli = {version = ">=1", markers = "python_version < \"3.11\""} [package.extras] dev = ["argcomplete", "attrs (>=19.2)", "hypothesis (>=3.56)", "mock", "requests", "setuptools", "xmlschema"] [[package]] name = "pytest-cov" version = "7.1.0" description = "Pytest plugin for measuring coverage." optional = false python-versions = ">=3.9" groups = ["dev"] files = [ {file = "pytest_cov-7.1.0-py3-none-any.whl", hash = "sha256:a0461110b7865f9a271aa1b51e516c9a95de9d696734a2f71e3e78f46e1d4678"}, {file = "pytest_cov-7.1.0.tar.gz", hash = "sha256:30674f2b5f6351aa09702a9c8c364f6a01c27aae0c1366ae8016160d1efc56b2"}, ] [package.dependencies] coverage = {version = ">=7.10.6", extras = ["toml"]} pluggy = ">=1.2" pytest = ">=7" [package.extras] testing = ["process-tests", "pytest-xdist", "virtualenv"] [[package]] name = "pyyaml" version = "6.0.3" description = "YAML parser and emitter for Python" optional = false python-versions = ">=3.8" groups = ["main"] files = [ {file = "PyYAML-6.0.3-cp38-cp38-macosx_10_13_x86_64.whl", hash = "sha256:c2514fceb77bc5e7a2f7adfaa1feb2fb311607c9cb518dbc378688ec73d8292f"}, {file = "PyYAML-6.0.3-cp38-cp38-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9c57bb8c96f6d1808c030b1687b9b5fb476abaa47f0db9c0101f5e9f394e97f4"}, {file = "PyYAML-6.0.3-cp38-cp38-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:efd7b85f94a6f21e4932043973a7ba2613b059c4a000551892ac9f1d11f5baf3"}, {file = "PyYAML-6.0.3-cp38-cp38-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:22ba7cfcad58ef3ecddc7ed1db3409af68d023b7f940da23c6c2a1890976eda6"}, {file = "PyYAML-6.0.3-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:6344df0d5755a2c9a276d4473ae6b90647e216ab4757f8426893b5dd2ac3f369"}, {file = "PyYAML-6.0.3-cp38-cp38-win32.whl", hash = "sha256:3ff07ec89bae51176c0549bc4c63aa6202991da2d9a6129d7aef7f1407d3f295"}, {file = "PyYAML-6.0.3-cp38-cp38-win_amd64.whl", hash = "sha256:5cf4e27da7e3fbed4d6c3d8e797387aaad68102272f8f9752883bc32d61cb87b"}, {file = "pyyaml-6.0.3-cp310-cp310-macosx_10_13_x86_64.whl", hash = "sha256:214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b"}, {file = "pyyaml-6.0.3-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:02ea2dfa234451bbb8772601d7b8e426c2bfa197136796224e50e35a78777956"}, {file = "pyyaml-6.0.3-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b30236e45cf30d2b8e7b3e85881719e98507abed1011bf463a8fa23e9c3e98a8"}, {file = "pyyaml-6.0.3-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:66291b10affd76d76f54fad28e22e51719ef9ba22b29e1d7d03d6777a9174198"}, {file = "pyyaml-6.0.3-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b"}, {file = "pyyaml-6.0.3-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:418cf3f2111bc80e0933b2cd8cd04f286338bb88bdc7bc8e6dd775ebde60b5e0"}, {file = "pyyaml-6.0.3-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:5e0b74767e5f8c593e8c9b5912019159ed0533c70051e9cce3e8b6aa699fcd69"}, {file = "pyyaml-6.0.3-cp310-cp310-win32.whl", hash = "sha256:28c8d926f98f432f88adc23edf2e6d4921ac26fb084b028c733d01868d19007e"}, {file = "pyyaml-6.0.3-cp310-cp310-win_amd64.whl", hash = "sha256:bdb2c67c6c1390b63c6ff89f210c8fd09d9a1217a465701eac7316313c915e4c"}, {file = "pyyaml-6.0.3-cp311-cp311-macosx_10_13_x86_64.whl", hash = "sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e"}, {file = "pyyaml-6.0.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824"}, {file = "pyyaml-6.0.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c"}, {file = "pyyaml-6.0.3-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00"}, {file = "pyyaml-6.0.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d"}, {file = "pyyaml-6.0.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:1d37d57ad971609cf3c53ba6a7e365e40660e3be0e5175fa9f2365a379d6095a"}, {file = "pyyaml-6.0.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4"}, {file = "pyyaml-6.0.3-cp311-cp311-win32.whl", hash = "sha256:8098f252adfa6c80ab48096053f512f2321f0b998f98150cea9bd23d83e1467b"}, {file = "pyyaml-6.0.3-cp311-cp311-win_amd64.whl", hash = "sha256:9f3bfb4965eb874431221a3ff3fdcddc7e74e3b07799e0e84ca4a0f867d449bf"}, {file = "pyyaml-6.0.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196"}, {file = "pyyaml-6.0.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0"}, {file = "pyyaml-6.0.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28"}, {file = "pyyaml-6.0.3-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c"}, {file = "pyyaml-6.0.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc"}, {file = "pyyaml-6.0.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e"}, {file = "pyyaml-6.0.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea"}, {file = "pyyaml-6.0.3-cp312-cp312-win32.whl", hash = "sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5"}, {file = "pyyaml-6.0.3-cp312-cp312-win_amd64.whl", hash = "sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b"}, {file = "pyyaml-6.0.3-cp312-cp312-win_arm64.whl", hash = "sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd"}, {file = "pyyaml-6.0.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8"}, {file = "pyyaml-6.0.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1"}, {file = "pyyaml-6.0.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c"}, {file = "pyyaml-6.0.3-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5"}, {file = "pyyaml-6.0.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6"}, {file = "pyyaml-6.0.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6"}, {file = "pyyaml-6.0.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be"}, {file = "pyyaml-6.0.3-cp313-cp313-win32.whl", hash = "sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26"}, {file = "pyyaml-6.0.3-cp313-cp313-win_amd64.whl", hash = "sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c"}, {file = "pyyaml-6.0.3-cp313-cp313-win_arm64.whl", hash = "sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb"}, {file = "pyyaml-6.0.3-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:8d1fab6bb153a416f9aeb4b8763bc0f22a5586065f86f7664fc23339fc1c1fac"}, {file = "pyyaml-6.0.3-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:34d5fcd24b8445fadc33f9cf348c1047101756fd760b4dacb5c3e99755703310"}, {file = "pyyaml-6.0.3-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:501a031947e3a9025ed4405a168e6ef5ae3126c59f90ce0cd6f2bfc477be31b7"}, {file = "pyyaml-6.0.3-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:b3bc83488de33889877a0f2543ade9f70c67d66d9ebb4ac959502e12de895788"}, {file = "pyyaml-6.0.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5"}, {file = "pyyaml-6.0.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:7c6610def4f163542a622a73fb39f534f8c101d690126992300bf3207eab9764"}, {file = "pyyaml-6.0.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:5190d403f121660ce8d1d2c1bb2ef1bd05b5f68533fc5c2ea899bd15f4399b35"}, {file = "pyyaml-6.0.3-cp314-cp314-win_amd64.whl", hash = "sha256:4a2e8cebe2ff6ab7d1050ecd59c25d4c8bd7e6f400f5f82b96557ac0abafd0ac"}, {file = "pyyaml-6.0.3-cp314-cp314-win_arm64.whl", hash = "sha256:93dda82c9c22deb0a405ea4dc5f2d0cda384168e466364dec6255b293923b2f3"}, {file = "pyyaml-6.0.3-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:02893d100e99e03eda1c8fd5c441d8c60103fd175728e23e431db1b589cf5ab3"}, {file = "pyyaml-6.0.3-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:c1ff362665ae507275af2853520967820d9124984e0f7466736aea23d8611fba"}, {file = "pyyaml-6.0.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6adc77889b628398debc7b65c073bcb99c4a0237b248cacaf3fe8a557563ef6c"}, {file = "pyyaml-6.0.3-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a80cb027f6b349846a3bf6d73b5e95e782175e52f22108cfa17876aaeff93702"}, {file = "pyyaml-6.0.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c"}, {file = "pyyaml-6.0.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:66e1674c3ef6f541c35191caae2d429b967b99e02040f5ba928632d9a7f0f065"}, {file = "pyyaml-6.0.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:16249ee61e95f858e83976573de0f5b2893b3677ba71c9dd36b9cf8be9ac6d65"}, {file = "pyyaml-6.0.3-cp314-cp314t-win_amd64.whl", hash = "sha256:4ad1906908f2f5ae4e5a8ddfce73c320c2a1429ec52eafd27138b7f1cbe341c9"}, {file = "pyyaml-6.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b"}, {file = "pyyaml-6.0.3-cp39-cp39-macosx_10_13_x86_64.whl", hash = "sha256:b865addae83924361678b652338317d1bd7e79b1f4596f96b96c77a5a34b34da"}, {file = "pyyaml-6.0.3-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:c3355370a2c156cffb25e876646f149d5d68f5e0a3ce86a5084dd0b64a994917"}, {file = "pyyaml-6.0.3-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3c5677e12444c15717b902a5798264fa7909e41153cdf9ef7ad571b704a63dd9"}, {file = "pyyaml-6.0.3-cp39-cp39-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5ed875a24292240029e4483f9d4a4b8a1ae08843b9c54f43fcc11e404532a8a5"}, {file = "pyyaml-6.0.3-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a"}, {file = "pyyaml-6.0.3-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926"}, {file = "pyyaml-6.0.3-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:27c0abcb4a5dac13684a37f76e701e054692a9b2d3064b70f5e4eb54810553d7"}, {file = "pyyaml-6.0.3-cp39-cp39-win32.whl", hash = "sha256:1ebe39cb5fc479422b83de611d14e2c0d3bb2a18bbcb01f229ab3cfbd8fee7a0"}, {file = "pyyaml-6.0.3-cp39-cp39-win_amd64.whl", hash = "sha256:2e71d11abed7344e42a8849600193d15b6def118602c4c176f748e4583246007"}, {file = "pyyaml-6.0.3.tar.gz", hash = "sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f"}, ] [[package]] name = "requests" version = "2.33.1" description = "Python HTTP for Humans." optional = false python-versions = ">=3.10" groups = ["main"] files = [ {file = "requests-2.33.1-py3-none-any.whl", hash = "sha256:4e6d1ef462f3626a1f0a0a9c42dd93c63bad33f9f1c1937509b8c5c8718ab56a"}, {file = "requests-2.33.1.tar.gz", hash = "sha256:18817f8c57c6263968bc123d237e3b8b08ac046f5456bd1e307ee8f4250d3517"}, ] [package.dependencies] certifi = ">=2023.5.7" charset_normalizer = ">=2,<4" idna = ">=2.5,<4" urllib3 = ">=1.26,<3" [package.extras] socks = ["PySocks (>=1.5.6,!=1.5.7)"] use-chardet-on-py3 = ["chardet (>=3.0.2,<8)"] [[package]] name = "tomli" version = "2.4.1" description = "A lil' TOML parser" optional = false python-versions = ">=3.8" groups = ["dev"] markers = "python_full_version <= \"3.11.0a6\"" files = [ {file = "tomli-2.4.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:f8f0fc26ec2cc2b965b7a3b87cd19c5c6b8c5e5f436b984e85f486d652285c30"}, {file = "tomli-2.4.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:4ab97e64ccda8756376892c53a72bd1f964e519c77236368527f758fbc36a53a"}, {file = "tomli-2.4.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:96481a5786729fd470164b47cdb3e0e58062a496f455ee41b4403be77cb5a076"}, {file = "tomli-2.4.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5a881ab208c0baf688221f8cecc5401bd291d67e38a1ac884d6736cbcd8247e9"}, {file = "tomli-2.4.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:47149d5bd38761ac8be13a84864bf0b7b70bc051806bc3669ab1cbc56216b23c"}, {file = "tomli-2.4.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:ec9bfaf3ad2df51ace80688143a6a4ebc09a248f6ff781a9945e51937008fcbc"}, {file = "tomli-2.4.1-cp311-cp311-win32.whl", hash = "sha256:ff2983983d34813c1aeb0fa89091e76c3a22889ee83ab27c5eeb45100560c049"}, {file = "tomli-2.4.1-cp311-cp311-win_amd64.whl", hash = "sha256:5ee18d9ebdb417e384b58fe414e8d6af9f4e7a0ae761519fb50f721de398dd4e"}, {file = "tomli-2.4.1-cp311-cp311-win_arm64.whl", hash = "sha256:c2541745709bad0264b7d4705ad453b76ccd191e64aa6f0fc66b69a293a45ece"}, {file = "tomli-2.4.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:c742f741d58a28940ce01d58f0ab2ea3ced8b12402f162f4d534dfe18ba1cd6a"}, {file = "tomli-2.4.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:7f86fd587c4ed9dd76f318225e7d9b29cfc5a9d43de44e5754db8d1128487085"}, {file = "tomli-2.4.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ff18e6a727ee0ab0388507b89d1bc6a22b138d1e2fa56d1ad494586d61d2eae9"}, {file = "tomli-2.4.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:136443dbd7e1dee43c68ac2694fde36b2849865fa258d39bf822c10e8068eac5"}, {file = "tomli-2.4.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:5e262d41726bc187e69af7825504c933b6794dc3fbd5945e41a79bb14c31f585"}, {file = "tomli-2.4.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:5cb41aa38891e073ee49d55fbc7839cfdb2bc0e600add13874d048c94aadddd1"}, {file = "tomli-2.4.1-cp312-cp312-win32.whl", hash = "sha256:da25dc3563bff5965356133435b757a795a17b17d01dbc0f42fb32447ddfd917"}, {file = "tomli-2.4.1-cp312-cp312-win_amd64.whl", hash = "sha256:52c8ef851d9a240f11a88c003eacb03c31fc1c9c4ec64a99a0f922b93874fda9"}, {file = "tomli-2.4.1-cp312-cp312-win_arm64.whl", hash = "sha256:f758f1b9299d059cc3f6546ae2af89670cb1c4d48ea29c3cacc4fe7de3058257"}, {file = "tomli-2.4.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:36d2bd2ad5fb9eaddba5226aa02c8ec3fa4f192631e347b3ed28186d43be6b54"}, {file = "tomli-2.4.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:eb0dc4e38e6a1fd579e5d50369aa2e10acfc9cace504579b2faabb478e76941a"}, {file = "tomli-2.4.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c7f2c7f2b9ca6bdeef8f0fa897f8e05085923eb091721675170254cbc5b02897"}, {file = "tomli-2.4.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f3c6818a1a86dd6dca7ddcaaf76947d5ba31aecc28cb1b67009a5877c9a64f3f"}, {file = "tomli-2.4.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d312ef37c91508b0ab2cee7da26ec0b3ed2f03ce12bd87a588d771ae15dcf82d"}, {file = "tomli-2.4.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:51529d40e3ca50046d7606fa99ce3956a617f9b36380da3b7f0dd3dd28e68cb5"}, {file = "tomli-2.4.1-cp313-cp313-win32.whl", hash = "sha256:2190f2e9dd7508d2a90ded5ed369255980a1bcdd58e52f7fe24b8162bf9fedbd"}, {file = "tomli-2.4.1-cp313-cp313-win_amd64.whl", hash = "sha256:8d65a2fbf9d2f8352685bc1364177ee3923d6baf5e7f43ea4959d7d8bc326a36"}, {file = "tomli-2.4.1-cp313-cp313-win_arm64.whl", hash = "sha256:4b605484e43cdc43f0954ddae319fb75f04cc10dd80d830540060ee7cd0243cd"}, {file = "tomli-2.4.1-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:fd0409a3653af6c147209d267a0e4243f0ae46b011aa978b1080359fddc9b6cf"}, {file = "tomli-2.4.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:a120733b01c45e9a0c34aeef92bf0cf1d56cfe81ed9d47d562f9ed591a9828ac"}, {file = "tomli-2.4.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:559db847dc486944896521f68d8190be1c9e719fced785720d2216fe7022b662"}, {file = "tomli-2.4.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:01f520d4f53ef97964a240a035ec2a869fe1a37dde002b57ebc4417a27ccd853"}, {file = "tomli-2.4.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:7f94b27a62cfad8496c8d2513e1a222dd446f095fca8987fceef261225538a15"}, {file = "tomli-2.4.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:ede3e6487c5ef5d28634ba3f31f989030ad6af71edfb0055cbbd14189ff240ba"}, {file = "tomli-2.4.1-cp314-cp314-win32.whl", hash = "sha256:3d48a93ee1c9b79c04bb38772ee1b64dcf18ff43085896ea460ca8dec96f35f6"}, {file = "tomli-2.4.1-cp314-cp314-win_amd64.whl", hash = "sha256:88dceee75c2c63af144e456745e10101eb67361050196b0b6af5d717254dddf7"}, {file = "tomli-2.4.1-cp314-cp314-win_arm64.whl", hash = "sha256:b8c198f8c1805dc42708689ed6864951fd2494f924149d3e4bce7710f8eb5232"}, {file = "tomli-2.4.1-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:d4d8fe59808a54658fcc0160ecfb1b30f9089906c50b23bcb4c69eddc19ec2b4"}, {file = "tomli-2.4.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:7008df2e7655c495dd12d2a4ad038ff878d4ca4b81fccaf82b714e07eae4402c"}, {file = "tomli-2.4.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1d8591993e228b0c930c4bb0db464bdad97b3289fb981255d6c9a41aedc84b2d"}, {file = "tomli-2.4.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:734e20b57ba95624ecf1841e72b53f6e186355e216e5412de414e3c51e5e3c41"}, {file = "tomli-2.4.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:8a650c2dbafa08d42e51ba0b62740dae4ecb9338eefa093aa5c78ceb546fcd5c"}, {file = "tomli-2.4.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:504aa796fe0569bb43171066009ead363de03675276d2d121ac1a4572397870f"}, {file = "tomli-2.4.1-cp314-cp314t-win32.whl", hash = "sha256:b1d22e6e9387bf4739fbe23bfa80e93f6b0373a7f1b96c6227c32bef95a4d7a8"}, {file = "tomli-2.4.1-cp314-cp314t-win_amd64.whl", hash = "sha256:2c1c351919aca02858f740c6d33adea0c5deea37f9ecca1cc1ef9e884a619d26"}, {file = "tomli-2.4.1-cp314-cp314t-win_arm64.whl", hash = "sha256:eab21f45c7f66c13f2a9e0e1535309cee140182a9cdae1e041d02e47291e8396"}, {file = "tomli-2.4.1-py3-none-any.whl", hash = "sha256:0d85819802132122da43cb86656f8d1f8c6587d54ae7dcaf30e90533028b49fe"}, {file = "tomli-2.4.1.tar.gz", hash = "sha256:7c7e1a961a0b2f2472c1ac5b69affa0ae1132c39adcb67aba98568702b9cc23f"}, ] [[package]] name = "types-pyyaml" version = "6.0.12.20260408" description = "Typing stubs for PyYAML" optional = false python-versions = ">=3.10" groups = ["main"] files = [ {file = "types_pyyaml-6.0.12.20260408-py3-none-any.whl", hash = "sha256:fbc42037d12159d9c801ebfcc79ebd28335a7c13b08a4cfbc6916df78fee9384"}, {file = "types_pyyaml-6.0.12.20260408.tar.gz", hash = "sha256:92a73f2b8d7f39ef392a38131f76b970f8c66e4c42b3125ae872b7c93b556307"}, ] [[package]] name = "typing-extensions" version = "4.15.0" description = "Backported and Experimental Type Hints for Python 3.9+" optional = false python-versions = ">=3.9" groups = ["main", "dev"] files = [ {file = "typing_extensions-4.15.0-py3-none-any.whl", hash = "sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548"}, {file = "typing_extensions-4.15.0.tar.gz", hash = "sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466"}, ] markers = {dev = "python_version == \"3.10\""} [[package]] name = "urllib3" version = "2.6.3" description = "HTTP library with thread-safe connection pooling, file post, and more." optional = false python-versions = ">=3.9" groups = ["main"] files = [ {file = "urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4"}, {file = "urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed"}, ] [package.extras] brotli = ["brotli (>=1.2.0) ; platform_python_implementation == \"CPython\"", "brotlicffi (>=1.2.0.0) ; platform_python_implementation != \"CPython\""] h2 = ["h2 (>=4,<5)"] socks = ["pysocks (>=1.5.6,!=1.5.7,<2.0)"] zstd = ["backports-zstd (>=1.0.0) ; python_version < \"3.14\""] [[package]] name = "wcwidth" version = "0.6.0" description = "Measures the displayed width of unicode strings in a terminal" optional = false python-versions = ">=3.8" groups = ["main"] files = [ {file = "wcwidth-0.6.0-py3-none-any.whl", hash = "sha256:1a3a1e510b553315f8e146c54764f4fb6264ffad731b3d78088cdb1478ffbdad"}, {file = "wcwidth-0.6.0.tar.gz", hash = "sha256:cdc4e4262d6ef9a1a57e018384cbeb1208d8abbc64176027e2c2455c81313159"}, ] [metadata] lock-version = "2.1" python-versions = "^3.10" content-hash = "14a8bc5c4884b0eab885563b332f3b89f335bc36ef1cfabd9f176df9e8100760" SigmaHQ-sigma-cli-f40f47a/print-coverage.py000066400000000000000000000007001517101166100205560ustar00rootroot00000000000000# Prints code testing coverage as percentage for badge generation. from defusedxml.ElementTree import parse tree = parse("cov.xml") root = tree.getroot() coverage = float(root.attrib["line-rate"]) * 100 print(f"COVERAGE={coverage:3.4}%") if coverage >= 95.0: print("COVERAGE_COLOR=green") elif coverage >= 90.0: print("COVERAGE_COLOR=yellow") elif coverage >= 85.0: print("COVERAGE_COLOR=orange") else: print("COVERAGE_COLOR=red") SigmaHQ-sigma-cli-f40f47a/pyproject.toml000066400000000000000000000024031517101166100201750ustar00rootroot00000000000000[tool.poetry] name = "sigma-cli" version = "3.0.2" description = "Sigma Command Line Interface (conversion, check etc.) based on pySigma" authors = ["Thomas Patzke "] license = "LGPL-2.1-or-later" readme = "README.md" repository = "https://github.com/SigmaHQ/sigma-cli" classifiers = [ "Development Status :: 4 - Beta", "Intended Audience :: System Administrators", "License :: OSI Approved :: GNU Lesser General Public License v2 (LGPLv2)", "Programming Language :: Python :: 3.8", "Programming Language :: Python :: 3.9", "Programming Language :: Python :: 3.10", "Topic :: Security" ] packages = [ { include = "sigma" } ] [tool.poetry.dependencies] python = "^3.10" click = "^8.3.1" prettytable = "^3.17.0" pysigma = ">=1.3.0,<2.0.0" colorama = "^0.4.6" [tool.poetry.group.dev.dependencies] pytest = "^9.0.1" pytest-cov = "^7.0.0" defusedxml = "^0.7.1" [tool.poetry.scripts] sigma = "sigma.cli.main:main" [tool.pytest.ini_options] minversion = "6.0" python_files = "test_*.py" addopts = "--cov=sigma --cov-report term --cov-report xml:cov.xml" testpaths = [ "tests", ] filterwarnings = [ 'ignore:Unverified HTTPS request' ] [build-system] requires = ["poetry-core>=1.0.0"] build-backend = "poetry.core.masonry.api" SigmaHQ-sigma-cli-f40f47a/sigma/000077500000000000000000000000001517101166100163625ustar00rootroot00000000000000SigmaHQ-sigma-cli-f40f47a/sigma/analyze/000077500000000000000000000000001517101166100200255ustar00rootroot00000000000000SigmaHQ-sigma-cli-f40f47a/sigma/analyze/attack.py000066400000000000000000000041341517101166100216500ustar00rootroot00000000000000from typing import Callable, Dict, Iterable, List from sigma.rule import SigmaRule, SigmaLevel, SigmaStatus from sigma.rule import SigmaRule, SigmaLevel from sigma.collection import SigmaCollection from collections import defaultdict def score_count(rules: Iterable[SigmaRule]) -> int: """Return count of rules.""" return len(list(rules)) def score_max(rules: Iterable[SigmaRule]) -> int: """Return maximum rule level value.""" return max( map(lambda rule: rule.level.value if rule.level is not None else 0, rules) ) rule_level_scores = { None: 1, SigmaLevel.INFORMATIONAL: 1, SigmaLevel.LOW: 2, SigmaLevel.MEDIUM: 4, SigmaLevel.HIGH: 8, SigmaLevel.CRITICAL: 12, } def rule_score(rule: SigmaRule) -> int: """Calculate rule score according to rule_level_scores.""" return rule_level_scores[rule.level] def score_level(rules: Iterable[SigmaRule]) -> int: return sum(map(rule_score, rules)) score_functions = { "count": (score_count, "Count of rules"), "max": (score_max, "Maximum severity value"), "level": (score_level, "Summarized level score"), } def calculate_attack_scores( rules: SigmaCollection, score_function: Callable[[Iterable[SigmaRule]], int], no_subtechniques: bool = False, min_sigmalevel: SigmaLevel = SigmaLevel.INFORMATIONAL, min_sigmastatus: SigmaStatus = SigmaStatus.UNSUPPORTED, ) -> Dict[str, int]: """Generate MITRE™️ ATT&CK Navigator heatmap according to scoring function.""" attack_rules = defaultdict(list) for rule in rules: level = rule.level if rule.level else min_sigmalevel status = rule.status if rule.status else min_sigmastatus if level >= min_sigmalevel and status >= min_sigmastatus: for tag in rule.tags: if tag.namespace == "attack": technique = tag.name.upper() if no_subtechniques: technique = technique.split(".")[0] attack_rules[technique].append(rule) return {attack: score_function(rules) for attack, rules in attack_rules.items()} SigmaHQ-sigma-cli-f40f47a/sigma/analyze/fields.py000066400000000000000000000207311517101166100216500ustar00rootroot00000000000000"""Extract field names from Sigma rules.""" from __future__ import annotations from operator import add from typing import List, Set, Tuple, Dict, Union from sigma.rule import SigmaRule, SigmaDetection, SigmaDetectionItem from sigma.collection import SigmaCollection from sigma.correlations import SigmaCorrelationRule from sigma.exceptions import SigmaError, SigmaPlaceholderError from sigma.modifiers import SigmaExpandModifier from sigma.types import SigmaString from sigma.processing.pipeline import ProcessingPipeline def get_fields( backend, rule: SigmaRule | SigmaCorrelationRule, collect_errors: bool = True, ) -> Tuple[List[str], List[SigmaError]]: """Extract field names from a Sigma rule. Args: backend: A Backend instance used to escape and quote field names rule: A SigmaRule or SigmaCorrelationRule to extract fields from collect_errors: Whether to collect errors. Defaults to True. Returns: Tuple[List[str], List[SigmaError]]: A list of fields and any errors found """ fields: List[str] = [] errors: List[SigmaError] = [] def noop(field: str) -> str: """A no-op function that returns the field as-is.""" return field # Get the field escaper from the backend escape_and_quote_field = getattr(backend, "escape_and_quote_field", lambda x: x) if not callable(escape_and_quote_field): escape_and_quote_field = noop if isinstance(rule, SigmaRule): if not rule.detection: return fields, errors # Extract fields from each detection for key in frozenset(rule.detection.detections.keys()): _fields, _errors = _get_fields_from_detection_items( backend, rule.detection.detections[key].detection_items, collect_errors, ) fields.extend(_fields) errors.extend(_errors) elif isinstance(rule, SigmaCorrelationRule): # Handle correlation rules if rule.group_by: fields.extend([escape_and_quote_field(field) for field in rule.group_by]) # Handle aliases if rule.aliases: aliases_to_remove = set() for field_alias in rule.aliases: esc_field_alias = escape_and_quote_field(field_alias.alias) if esc_field_alias in fields: aliases_to_remove.add(esc_field_alias) fields.extend([ escape_and_quote_field(field) for field in field_alias.mapping.values() ]) fields = [f for f in fields if f not in aliases_to_remove] return fields, errors def _get_fields_from_detection_items( backend, detection_items: List[SigmaDetectionItem | SigmaDetection], collect_errors: bool = True, ) -> Tuple[List[str], List[SigmaError]]: """Extract fields from detection items recursively. Args: backend: A Backend instance used to escape and quote field names detection_items: A list of SigmaDetectionItem or SigmaDetection collect_errors: Whether to collect errors. Defaults to True. Returns: Tuple[List[str], List[SigmaError]]: A list of fields and any errors found """ fields: List[str] = [] errors: List[SigmaError] = [] def noop(field: str) -> str: """A no-op function that returns the field as-is.""" return field escape_and_quote_field = getattr(backend, "escape_and_quote_field", lambda x: x) if not callable(escape_and_quote_field): escape_and_quote_field = noop for di in detection_items: if isinstance(di, SigmaDetectionItem) and hasattr(di, "field") and di.field: if collect_errors: # Check for unexpanded placeholders has_placeholder_modifier = any( [ is_sem for mod in di.modifiers if (is_sem := issubclass(mod, SigmaExpandModifier)) ] ) has_placeholder_value = any( [ is_placeholder for val in di.value if ( is_placeholder := isinstance(val, SigmaString) and ( hasattr(val, "contains_placeholder") and val.contains_placeholder() ) ) ] ) if all([has_placeholder_modifier, has_placeholder_value]): errors.append( SigmaPlaceholderError( "Cannot extract fields from Sigma rule with unexpanded placeholders." ) ) fields.append(escape_and_quote_field(di.field)) elif isinstance(di, SigmaDetection): # Recursively extract fields from nested detections _fields, _errors = _get_fields_from_detection_items( backend, di.detection_items, collect_errors ) fields.extend(_fields) errors.extend(_errors) return fields, errors def extract_fields_from_collection( collection: SigmaCollection, backend, group = False, collect_errors: bool = True, ) -> Tuple[Union[Set[str], Dict[str, Set[str]]], List[SigmaError]]: """Extract all unique field names from a Sigma collection. Args: collection: A SigmaCollection to extract fields from backend: A Backend instance used to escape and quote field names group: Whether to group fields by logsource. Defaults to False. collect_errors: Whether to collect errors. Defaults to True. Returns: Tuple[Union[Set[str], Dict[str, Set[str]]], List[SigmaError]]: A set of unique field names (or a dict of set if grouped) and any errors found """ all_fields: Set[str] = set() grouped_fields: Dict[str, Set[str]] = {} all_errors: List[SigmaError] = [] for rule in collection: # Try to apply any processing pipelines if available last_processing_pipeline = getattr(rule, "last_processing_pipeline", None) if not last_processing_pipeline: backend_processing_pipeline = ( getattr(backend, "backend_processing_pipeline", None) or None ) processing_pipeline = getattr(backend, "processing_pipeline", None) or None output_format_processing_pipeline = ( getattr(backend, "output_format_processing_pipeline", None) or None ) if output_format_processing_pipeline and isinstance(output_format_processing_pipeline, dict): output_format_processing_pipeline = ( output_format_processing_pipeline.get( getattr(backend, "format", "default") ) ) if backend_processing_pipeline is None: backend_processing_pipeline = ProcessingPipeline() if processing_pipeline is None: processing_pipeline = ProcessingPipeline() if output_format_processing_pipeline is None: output_format_processing_pipeline = ProcessingPipeline() last_processing_pipeline = add( backend_processing_pipeline, add(processing_pipeline, output_format_processing_pipeline), ) # Apply the processing pipeline to the rule try: rule = last_processing_pipeline.apply(rule) except Exception: # If pipeline application fails, continue with the rule as-is pass # Extract fields from the rule fields, errors = get_fields(backend, rule, collect_errors) all_fields.update(fields) all_errors.extend(errors) if group: if isinstance(rule, SigmaRule): # Correlations not supported, they don't have logsource logsource = f"{rule.logsource.category or ''}|{rule.logsource.product or ''}|{rule.logsource.service or ''}" if logsource not in grouped_fields: grouped_fields[logsource] = set() grouped_fields[logsource].update(fields) if group: return grouped_fields, all_errors else: return all_fields, all_errors SigmaHQ-sigma-cli-f40f47a/sigma/analyze/stats.py000066400000000000000000000026671517101166100215500ustar00rootroot00000000000000import copy from typing import Dict, List from sigma.rule import SigmaRule, SigmaLevel from sigma.collection import SigmaCollection rule_level_mapping = { None: "None", SigmaLevel.INFORMATIONAL: "Informational", SigmaLevel.LOW: "Low", SigmaLevel.MEDIUM: "Medium", SigmaLevel.HIGH: "High", SigmaLevel.CRITICAL: "Critical", } template_stat_detail = { "Overall": 0, "Critical": 0, "High": 0, "Medium": 0, "Low": 0, "Informational": 0, "None": 0, } def format_row(row: str, column_widths: List) -> str: """Format rows for table.""" return " | ".join( f"{str(item).ljust(width)}" for item, width in zip(row, column_widths) ) def get_rulelevel_mapping(rule: SigmaRule) -> int: """Calculate rule score according to rule_level_scores.""" return rule_level_mapping[rule.level] def create_logsourcestats(rules: SigmaCollection) -> Dict[str, int]: """ Iterate through all the rules and count SigmaLevel grouped by Logsource Category Name. """ stats = {} for rule in rules: if hasattr(rule, "logsource"): # Create stats key for logsource category. if not rule.logsource.category in stats: stats[rule.logsource.category] = copy.deepcopy(template_stat_detail) stats[rule.logsource.category]["Overall"] += 1 stats[rule.logsource.category][get_rulelevel_mapping(rule)] += 1 return stats SigmaHQ-sigma-cli-f40f47a/sigma/cli/000077500000000000000000000000001517101166100171315ustar00rootroot00000000000000SigmaHQ-sigma-cli-f40f47a/sigma/cli/analyze.py000066400000000000000000000240431517101166100211510ustar00rootroot00000000000000import json import pathlib import click from prettytable import PrettyTable from sigma.processing.resolver import SigmaPipelineNotFoundError from sigma.cli.convert import pipeline_resolver from sigma.cli.rules import check_rule_errors, load_rules from sigma.analyze.attack import score_functions, calculate_attack_scores from sigma.analyze.fields import extract_fields_from_collection from sigma.analyze.stats import create_logsourcestats, format_row from sigma.rule import SigmaLevel, SigmaStatus from sigma.plugins import InstalledSigmaPlugins from sigma.conversion.base import Backend @click.group(name="analyze", help="Analyze Sigma rule sets") def analyze_group(): pass @analyze_group.command( name="attack", help="Create MITRE™️ ATT&CK heatmaps from Sigma rule set. Score functions are: " + ", ".join( (f"{definition[1]} ({func})" for func, definition in score_functions.items()) ), ) @click.option( "--file-pattern", "-P", default="*.yml", show_default=True, help="Pattern for file names to be included in recursion into directories.", ) @click.option( "--min-level", "-L", default="INFORMATIONAL", help="The minimun level of the rule to be include.", ) @click.option( "--min-status", "-T", default="UNSUPPORTED", help="The minimun status of the rule to be include.", ) @click.option( "--subtechniques/--no-subtechniques", "-s/-S", default=True, ) @click.option( "--max-color", "-c", default="#ff0000", show_default=True, help="Color used for maximum score.", ) @click.option( "--min-color", "-C", default="#ffffff00", show_default=True, help="Color used for zero score.", ) @click.option( "--max-score", "-m", type=int, default=None, help="Set fixed maximum score. All scores above are rendered as maximum. Increases color scale resolution for scores below.", ) @click.option( "--min-score", "-M", type=int, default="0", show_default=True, help="Minimum score. All scores below are not explicitly colored.", ) @click.argument( "function", type=click.Choice(score_functions.keys()), ) @click.argument( "output", type=click.File("w"), ) @click.argument( "input", nargs=-1, required=True, type=click.Path(exists=True, allow_dash=True, path_type=pathlib.Path), ) def analyze_attack( file_pattern, min_level, min_status, subtechniques, max_color, min_color, max_score, min_score, function, output, input, ): try: min_sigmalevel = SigmaLevel[min_level.upper()] except: min_sigmalevel = SigmaLevel.INFORMATIONAL try: min_sigmastatus = SigmaStatus[min_status.upper()] except: min_sigmastatus = SigmaStatus.UNSUPPORTED from sigma.data.mitre_attack import ( mitre_attack_techniques_tactics_mapping, mitre_attack_version, ) rules = load_rules(input, file_pattern) check_rule_errors(rules) score_function = score_functions[function][0] scores = calculate_attack_scores(rules, score_function, not subtechniques,min_sigmalevel=min_sigmalevel,min_sigmastatus=min_sigmastatus,) layer_techniques = [ { "techniqueID": technique, "tactic": tactic, "score": score, "color": "", "comment": "", "enabled": True, "metadata": [], "links": [], "showSubtechniques": False, } for technique, score in scores.items() for tactic in mitre_attack_techniques_tactics_mapping.get(technique, []) ] layer = { "name": "Sigma Analytics Coverage", "versions": { "attack": mitre_attack_version, "navigator": "4.8.1", "layer": "4.4", }, "domain": "enterprise-attack", "description": f"Sigma coverage heatmap generated by Sigma CLI with score function {function}", "gradient": { "colors": [ min_color, max_color, ], "minValue": min_score, "maxValue": max_score or max(scores.values()), }, "techniques": layer_techniques, } json.dump(layer, output, indent=2) @analyze_group.command(name="logsource", help="Create stats about logsources.") @click.option( "--file-pattern", "-P", default="*.yml", show_default=True, help="Pattern for file names to be included in recursion into directories.", ) @click.option( "--sort-by", "-k", type=str, default="Overall", show_default=True, help="Sort by column.", ) @click.argument( "output", type=click.File("w"), ) @click.argument( "input", nargs=-1, required=True, type=click.Path(exists=True, allow_dash=True, path_type=pathlib.Path), ) def analyze_logsource( file_pattern, sort_by, output, input, ): rules = load_rules(input, file_pattern) check_rule_errors(rules) stats = create_logsourcestats(rules) # Extract column header headers = ["Logsource"] + list(next(iter(stats.values())).keys()) # Prepare rows rows = [[key] + list(value.values()) for key, value in stats.items()] sort_index = headers.index(sort_by) rows.sort(key=lambda x: x[sort_index], reverse=True) # Determine col width column_widths = [ max(len(str(item)) for item in column) for column in zip(*([headers] + rows)) ] # Print table print("-+-".join("-" * width for width in column_widths), file=output) print(format_row(headers, column_widths), file=output) print("-+-".join("-" * width for width in column_widths), file=output) for row in rows: print(format_row(row, column_widths), file=output) @analyze_group.command( name="fields", help="Extract field names from Sigma rules for a given target backend and processing pipeline(s).", ) @click.option( "--file-pattern", "-P", default="*.yml", show_default=True, help="Pattern for file names to be included in recursion into directories.", ) @click.option( "--target", "-t", type=str, required=True, help="Target backend to use for field name escaping and quoting.", ) @click.option( "--pipeline", "-p", multiple=True, help="Specify processing pipelines as identifiers (" + click.style("sigma list pipelines", bold=True, fg="green") + ") or YAML files or directories", ) @click.option( "--pipeline-check/--disable-pipeline-check", default=True, help="Verify if a pipeline is used that is intended for another backend.", ) @click.option( "--group/--no-group", default=False, help="Group fields by logsource.", ) @click.option( "--enable-template-vars", is_flag=True, default=False, help="Enable template variable support in processing pipeline. WARNING: This feature can be dangerous and allow arbitrary code execution if used with untrusted Sigma rules.", ) @click.option( "--template-vars-path", multiple=True, type=click.Path(exists=True, path_type=pathlib.Path), help="Allowed paths for template variable expansion. Can be specified multiple times.", ) @click.argument( "input", nargs=-1, required=True, type=click.Path(exists=True, allow_dash=True, path_type=pathlib.Path), ) def analyze_fields(file_pattern, target, pipeline, pipeline_check, group, enable_template_vars, template_vars_path, input): """Extract field names from Sigma rule sets. This command extracts and outputs all unique field names present in the given Sigma rule collection, formatted for the specified target backend. """ # Load plugins and get available backends plugins = InstalledSigmaPlugins.autodiscover() backends = plugins.backends if target not in backends: available_targets = ", ".join(sorted(backends.keys())) raise click.ClickException( f"Unknown target '{target}'. Available targets are: {available_targets}" ) # Load rules rules = load_rules(input, file_pattern) check_rule_errors(rules) # Resolve pipelines try: processing_pipeline = pipeline_resolver.resolve( pipeline, target if pipeline_check else None ) # Configure template variable settings on the processing pipeline if enable_template_vars: processing_pipeline.allow_template_vars = True if template_vars_path: processing_pipeline.vars_allowed_paths = [str(p) for p in template_vars_path] except SigmaPipelineNotFoundError as e: raise click.UsageError( f"The pipeline '{e.spec}' was not found.\n" + "List all installed processing pipelines with: " + click.style(f"sigma list pipelines {target}", bold=True, fg="green") + "\n" "List pipeline plugins for installation with: " + click.style( f"sigma plugin list --plugin-type pipeline", bold=True, fg="green" ) + "\n" + "Pipelines not listed here are treated as file names." ) # Initialize backend backend_class = backends[target] try: backend: Backend = backend_class( processing_pipeline=processing_pipeline, collect_errors=True, ) except Exception as e: raise click.ClickException(f"Failed to initialize backend '{target}': {str(e)}") # Extract fields all_fields, errors = extract_fields_from_collection(rules, backend, group) # Handle errors if errors: click.echo("Warnings during field extraction:", err=True) for error in errors: click.echo(f"* {error}", err=True) if group: table = PrettyTable() table.field_names = ["Logsource", "Fields"] table.align["Logsource"] = "r" table.align["Fields"] = "l" for logsource, fields in sorted(all_fields.items()): table.add_row([logsource, "\n".join(sorted(fields))]) click.echo(table) else: # Output fields sorted click.echo("\n".join(sorted(all_fields))) SigmaHQ-sigma-cli-f40f47a/sigma/cli/check.py000066400000000000000000000232431517101166100205640ustar00rootroot00000000000000import pathlib from collections import Counter from sys import stderr from textwrap import fill from dataclasses import fields import click from prettytable import PrettyTable from sigma.cli.rules import load_rules from sigma.exceptions import SigmaConditionError, SigmaError from sigma.plugins import InstalledSigmaPlugins from sigma.validation import SigmaValidator from sigma.rule import SigmaRule severity_color = {"low": "green", "medium": "yellow", "high": "red"} # ========================================== # Data Processing & Extraction Functions # ========================================== def setup_validator(validation_config, exclude): plugins = InstalledSigmaPlugins.autodiscover() validators = plugins.validators if ( validation_config is None ): # no validation config provided, use basic config with all validators exclude_lower = [excluded.lower() for excluded in exclude] exclude_invalid = [ excluded for excluded in exclude_lower if excluded not in validators.keys() ] exclude_valid = [ excluded for excluded in exclude_lower if excluded not in exclude_invalid ] report_config_warnings(exclude_invalid, exclude_valid) validators_filtered = [ validator for name, validator in validators.items() if name.lower() not in exclude_valid ] rule_validator = SigmaValidator(validators_filtered) else: if exclude: click.echo( f"A configuration file and the `--exclude` parameter was set, ignoring the `--exclude` parameter." ) rule_validator = SigmaValidator.from_yaml(validation_config.read(), validators) return rule_validator # ========================================== # Reporting & Output Functions # ========================================== def report_config_warnings(exclude_invalid, exclude_valid): """Prints warnings regarding invalid or excluded validators.""" if len(exclude_invalid) > 0: click.echo(f"Invalid validators name : {exclude_invalid} use 'sigma list validators'") if len(exclude_valid) > 0: click.echo(f"Ignoring these validators : {exclude_valid}'") def validate_loaded_rules(check_rules, rule_validator): with click.progressbar( check_rules, label="Checking Sigma rules", file=stderr ) as rules: issues = rule_validator.validate_rules(rules) return issues def load_and_check_rules(input, file_pattern, rule_errors, cond_errors): rule_collection = load_rules(input, file_pattern) check_rules = list() first_error = True for rule in rule_collection.rules: if ( len(rule.errors) > 0 ): # rule has errors: print errors and skip further checking of rule if first_error: click.echo("=== Sigma Rule Errors ===") first_error = False for error in rule.errors: click.echo(error) rule_errors.update((error.__class__.__name__,)) elif isinstance(rule, SigmaRule): # rule has no errors, parse condition try: for condition in rule.detection.parsed_condition: condition.parse() check_rules.append(rule) except SigmaConditionError as e: # Error in condition error = str(e) click.echo( f"Condition error in { str(condition.source) }:{ error }" ) cond_errors.update((error,)) else: check_rules.append(rule) return check_rules @click.command() @click.option( "--validation-config", "-c", type=click.File("r"), help="Validation configuration file in YAML format.", ) @click.option( "--file-pattern", "-P", default="*.yml", show_default=True, help="Pattern for file names to be included in recursion into directories.", ) @click.option( "--fail-on-error/--pass-on-error", "-e/-E", default=True, show_default=True, help="Fail on Sigma rule parsing errors.", ) @click.option( "--fail-on-issues/--pass-on-issues", "-i/-I", default=False, show_default=True, help="Fail on Sigma rule validation issues.", ) @click.option( "--exclude", "-x", default=[], show_default=True, multiple=True, help="List of validators to exclude from the validation. Repeat --exclude for multiple exclusions.", ) @click.argument( "input", nargs=-1, required=True, type=click.Path(exists=True, allow_dash=True, path_type=pathlib.Path), ) def check( input, validation_config, file_pattern, fail_on_error, fail_on_issues, exclude ): """Check Sigma rules for validity and best practices (not yet implemented).""" rule_validator = setup_validator(validation_config, exclude) try: rule_errors = Counter() cond_errors = Counter() check_rules = load_and_check_rules(input, file_pattern, rule_errors, cond_errors) # TODO: From Python 3.10 the commented line below can be used. rule_error_count = sum(rule_errors.values()) # rule_error_count = rule_errors.total() issues = validate_loaded_rules(check_rules, rule_validator) issue_count = len(issues) issue_counter = Counter() if issue_count > 0: click.echo("=== Issues ===") for issue in issues: # Need to split SigmaValidationIssue __str__ formatted_rules_output = ", ".join( [ str(rule_with_issue.source) if rule_with_issue.source is not None else str(rule_with_issue.id) or rule_with_issue.title for rule_with_issue in issue.rules ] ) additional_fields = " ".join( [ f"{field.name}={click.style(issue.__getattribute__(field.name) or '-', bold=True, fg='blue')}" for field in fields(issue) if field.name not in ("rules", "severity", "description") ] ) click.echo( "issue=" + click.style(issue.__class__.__name__, bold=True, fg="cyan") + " severity=" + click.style( issue.severity.name.lower(), bold=True, fg=severity_color[issue.severity.name.lower()], ) + " description=" + click.style(issue.description, bold=True, fg="blue") + " rule=" + click.style(formatted_rules_output, bold=True, fg="blue") + f" {additional_fields}" ) issue_counter.update((issue.__class__,)) # TODO: From Python 3.10 the commented line below can be used. cond_error_count = sum(cond_errors.values()) # cond_error_count = cond_errors.total() click.echo() click.echo("=== Summary ===") click.echo( f"Found {rule_error_count} errors, { cond_error_count } condition errors and { issue_count } issues." ) if rule_error_count > 0: click.echo("\nRule error summary:") rule_error_table = PrettyTable( field_names=("Count", "Rule Error"), align="l", ) rule_error_table.add_rows( [ (count, fill(error, width=60)) for error, count in sorted( rule_errors.items(), key=lambda item: item[1], reverse=True ) ] ) click.echo(rule_error_table.get_string()) else: click.echo("No rule errors found.") if cond_error_count > 0: click.echo("\nCondition error summary:") cond_error_table = PrettyTable( field_names=("Count", "Condition Error"), align="l", ) cond_error_table.add_rows( [ (count, fill(error, width=60)) for error, count in sorted( cond_errors.items(), key=lambda item: item[1], reverse=True ) ] ) click.echo(cond_error_table.get_string()) else: click.echo("No condition errors found.") if issue_count > 0: click.echo("\nValidation issue summary:") validation_issue_summary = PrettyTable( field_names=("Count", "Issue", "Severity", "Description"), align="l", ) validation_issue_summary.add_rows( [ ( count, issue.__name__, issue.severity.name, fill(issue.description, width=60), ) for issue, count in sorted( issue_counter.items(), key=lambda item: item[1], reverse=True ) ] ) click.echo(validation_issue_summary.get_string()) else: click.echo("No validation issues found.") if ( fail_on_error and (rule_error_count > 0 or cond_error_count > 0) or fail_on_issues and issue_count > 0 ): click.echo("Check failure") click.get_current_context().exit(1) except SigmaError as e: raise click.ClickException("Check error: " + str(e)) SigmaHQ-sigma-cli-f40f47a/sigma/cli/convert.py000066400000000000000000000303461517101166100211710ustar00rootroot00000000000000import json import pathlib import textwrap from typing import Sequence import click from sigma.cli.rules import load_rules, check_rule_errors from sigma.conversion.base import Backend from sigma.exceptions import ( SigmaError, SigmaPipelineNotAllowedForBackendError, SigmaPipelineNotFoundError, ) from sigma.plugins import InstalledSigmaPlugins plugins = InstalledSigmaPlugins.autodiscover() backends = plugins.backends pipelines = plugins.pipelines pipeline_resolver = plugins.get_pipeline_resolver() pipeline_list = list(pipeline_resolver.pipelines.keys()) class KeyValueParamType(click.ParamType): """ key=value type for backend-specific options. """ name = "key-value" def convert(self, value, param, ctx): if not isinstance(value, str): self.fail(f"Value must be a string with format key=value", param, ctx) try: k, v = value.split("=", 1) except ValueError: self.fail(f"Value '{value}' has not format key=value", param, ctx) try: return {k: int(v)} except ValueError: return {k: v} class ChoiceWithPluginHint(click.Choice): """Custom base class that shows a command line for listing the appropriate plugins if user tries to use an unknown backend or pipeline.""" def __init__( self, choices: Sequence[str], plugin_type: str, case_sensitive: bool = True ) -> None: self.plugin_type = plugin_type super().__init__(choices, case_sensitive) def fail(self, message: str, param, ctx): return super().fail( message + " - run " + click.style( f"sigma plugin list --plugin-type {self.plugin_type}", bold=True, fg="green", ) + " for a list of available plugins.", param, ctx, ) @click.command() @click.option( "--target", "-t", type=ChoiceWithPluginHint(backends.keys(), "backend"), required=True, help="Target query language (" + click.style("sigma list targets", bold=True, fg="green") + ")", ) @click.option( "--pipeline", "-p", multiple=True, help="Specify processing pipelines as identifiers (" + click.style("sigma list pipelines", bold=True, fg="green") + ") or YAML files or directories", ) @click.option( "--without-pipeline", is_flag=True, default=False, help="Proceed with conversion without processing pipeline, even if it is mandatory for the target.", ) @click.option( "--pipeline-check/--disable-pipeline-check", default=True, help="Verify if a pipeline is used that is intended for another backend.", ) @click.option( "--format", "-f", default="default", show_default=True, help="Select backend output format", ) @click.option( "--correlation-method", "-c", help="Select method for generation of correlation queries. If not given the default method of the backend is used." ) @click.option( "--filter", multiple=True, type=click.Path(exists=True, allow_dash=True, path_type=pathlib.Path), help="Select filters/exclusions to apply to the rules. Multiple Sigma meta filters can be applied.", ) @click.option( "--file-pattern", "-P", default="*.yml", show_default=True, help="Pattern for file names to be included in recursion into directories.", ) @click.option( "--skip-unsupported/--fail-unsupported", "-s/", default=False, help="Skip conversion of rules that can't be handled by the backend", ) @click.option( "--output", "-o", type=click.File("wb"), default="-", show_default=True, help="Write result to specified file. '-' writes to standard output.", ) @click.option( "--encoding", "-e", type=str, default="utf-8", show_default=True, help="Output encoding for string backend outputs. This is ignored for backends that return binary output.", ) @click.option( "--json-indent", "-j", type=int, default=None, help="Pretty-print and indent JSON output with given indentation width per level.", ) @click.option( "--backend-option", "-O", type=KeyValueParamType(), multiple=True, help="Backend-specific options provided as key=value pair.", ) @click.option( "--enable-template-vars", is_flag=True, default=False, help="Enable template variable support in processing pipeline. WARNING: This feature can be dangerous and allow arbitrary code execution if used with untrusted Sigma rules.", ) @click.option( "--template-vars-path", multiple=True, type=click.Path(exists=True, path_type=pathlib.Path), help="Allowed paths for template variable expansion. Can be specified multiple times.", ) @click.argument( "input", nargs=-1, required=True, type=click.Path(exists=True, allow_dash=True, path_type=pathlib.Path), ) @click.option( "--verbose", required=False, is_flag=True, default=False, type=click.BOOL, help="Verbose output.", ) def convert( target, pipeline, without_pipeline, pipeline_check, format, correlation_method, filter, skip_unsupported, output, encoding, json_indent, backend_option, enable_template_vars, template_vars_path, input, file_pattern, verbose, ): """ Convert Sigma rules into queries. INPUT can be multiple files or directories. This command automatically recurses into directories and converts all files matching the pattern in --file-pattern. """ # Check if pipeline is required if backends[target].requires_pipeline and pipeline == () and not without_pipeline: raise click.UsageError( textwrap.dedent( f""" Processing pipeline required by backend! Define a custom pipeline or choose a predefined one. Get all available pipelines for {target} with: """ + click.style(f"sigma list pipelines {target}", bold=True, fg="green") + """ If you never heard about processing pipelines you should get familiar with them (https://sigmahq-pysigma.readthedocs.io/en/latest/Processing_Pipelines.html). If you know what you're doing add --without-pipeline to your command line to suppress this error. """ ) ) # Merge backend options: multiple occurences of a key result in array of values backend_options = dict() for option in backend_option: for k, v in option.items(): backend_options.setdefault(k, list()).append(v) backend_options = { k: (v[0] if len(v) == 1 else v) # if there's only one item, return it. for k, v in backend_options.items() } # Initialize processing pipeline and backend backend_class = backends[target] try: processing_pipeline = pipeline_resolver.resolve( pipeline, target if pipeline_check else None ) # Configure template variable settings on the processing pipeline if enable_template_vars: processing_pipeline.allow_template_vars = True if template_vars_path: processing_pipeline.vars_allowed_paths = [str(p) for p in template_vars_path] except SigmaPipelineNotFoundError as e: raise click.UsageError( f"The pipeline '{e.spec}' was not found.\n" + "List all installed processing pipelines with: " + click.style(f"sigma list pipelines {target}", bold=True, fg="green") + "\n" "List pipeline plugins for installation with: " + click.style( f"sigma plugin list --plugin-type pipeline", bold=True, fg="green" ) + "\n" + "Pipelines not listed here are treated as file names." ) except SigmaPipelineNotAllowedForBackendError as e: raise click.UsageError( textwrap.dedent( f""" The pipeline '{e.wrong_pipeline}' is not intended to be used with the target {target}. You can list all pipelines that are intended to be used with this target with """ + click.style(f"sigma list pipelines {target}", bold=True, fg="green") + """. If you know what you're doing and want to use this pipeline(s) in this conversion, disable this check with --disable-pipeline-check. """ ) ) try: backend: Backend = backend_class( processing_pipeline=processing_pipeline, collect_errors=skip_unsupported, **backend_options, ) except TypeError as e: param = str(e).split("'")[1] raise click.BadParameter( f"Parameter '{param}' is not supported by backend '{target}'.", param_hint="backend_option", ) if format not in backends[target].formats.keys(): raise click.BadParameter( f"Output format '{format}' is not supported by backend '{target}'. Run " + click.style(f"sigma list formats {target}", bold=True, fg="green") + " to list all available formats of the target.", param_hint="format", ) if correlation_method is not None: correlation_methods = backend.correlation_methods if correlation_methods is None: raise click.BadParameter( f"Backend '{target}' does not support correlations but correlation method was provided on command line.", param_hint="correlation_method", ) elif correlation_method not in correlation_methods.keys(): raise click.BadParameter( f"Correlation method '{correlation_method}' is not supported by backend '{target}'. Run " + click.style(f"sigma list correlation-methods {target}", bold=True, fg="green") + " to list all available correlation methods of the target.", param_hint="correlation_method", ) try: rule_collection = load_rules(input + filter, file_pattern) check_rule_errors(rule_collection) result = backend.convert(rule_collection, format, correlation_method) if isinstance(result, str): # String result click.echo(bytes(result, encoding), output) elif isinstance(result, bytes): # Bytes result: only allow to write it to file. if output.isatty(): raise click.UsageError( "Backend returns binary output. Please provide output file with --output/-o." ) else: click.echo(result, output) elif isinstance(result, list) and all( ( # List of strings Concatenate with newlines in between. isinstance(item, str) for item in result ) ): click.echo(bytes("\n\n".join(result), encoding), output) elif isinstance(result, list) and all( ( # List of dicts: concatenate with newline and render each result als JSON. isinstance(item, dict) for item in result ) ): click.echo( bytes( "\n".join( (json.dumps(item, indent=json_indent) for item in result) ), encoding, ), output, ) elif isinstance(result, dict): click.echo(bytes(json.dumps(result, indent=json_indent), encoding)) else: raise click.ClickException( f"Backend returned unexpected format {str(type(result))}" ) except SigmaError as e: if verbose: click.echo('Error while converting') raise e else: raise click.ClickException("Error while converting: " + str(e)) except NotImplementedError as e: if verbose: click.echo('Feature required for conversion of Sigma rule is not supported by backend') raise e else: raise click.ClickException("Feature required for conversion of Sigma rule is not supported by backend: " + str(e)) if len(backend.errors) > 0: click.echo("\nIgnored errors:", err=True) for rule, error in backend.errors: click.echo(f"{str(rule.source)}: {str(error)}", err=True) SigmaHQ-sigma-cli-f40f47a/sigma/cli/list.py000066400000000000000000000211701517101166100204570ustar00rootroot00000000000000import click from sigma.plugins import InstalledSigmaPlugins from sigma.modifiers import modifier_mapping from sigma.processing.transformations import transformations from sigma.processing.conditions import ( rule_conditions, detection_item_conditions, field_name_conditions, ) from prettytable import PrettyTable from textwrap import dedent, fill plugins = InstalledSigmaPlugins.autodiscover() def _plugin_id_from_module(module_name: str, namespace: str) -> str: """Extract the Sigma plugin identifier from a module name. Sigma backends live in ``sigma.backends..*`` and pipelines in ``sigma.pipelines..*``. Splitting on '.' and picking the component after the namespace prefix returns the plugin identifier directly (e.g. ``sigma.backends.splunk.backend`` → ``splunk``). """ parts = module_name.split(".") # Expected layout: sigma . . [. submodule ...] try: idx = parts.index(namespace) plugin_id = parts[idx + 1] return plugin_id if plugin_id else "n/a" except (ValueError, IndexError): return "n/a" def _get_backend_plugin_id(backend_class) -> str: """Return the Sigma plugin identifier for a backend class.""" return _plugin_id_from_module(backend_class.__module__, "backends") def _get_pipeline_plugin_id(pipeline_obj) -> str: """Return the Sigma plugin identifier for a pipeline object or function.""" # Plain function: use its own module module_name = getattr(pipeline_obj, "__module__", None) if module_name and module_name != "sigma.pipelines.base": return _plugin_id_from_module(module_name, "pipelines") # Pipeline-decorator instance: retrieve the wrapped function's module func = getattr(pipeline_obj, "func", None) if func is not None: func_module = getattr(func, "__module__", None) if func_module: return _plugin_id_from_module(func_module, "pipelines") return "n/a" # Pre-compute plugin IDs for all discovered pipelines (keyed by identifier). # This must be done before the resolver resolves pipeline callables into plain # ProcessingPipeline objects, which no longer carry module information. _pipeline_plugin_ids: dict = { name: _get_pipeline_plugin_id(pipeline) for name, pipeline in plugins.pipelines.items() } @click.group(name="list", help="List available targets or processing pipelines.") def list_group(): pass @list_group.command(name="targets", help="List conversion target query languages.") def list_targets(): if len(plugins.backends) == 0: click.echo( "No backends installed. Use " + click.style("sigma plugin list", bold=True, fg="green") + " to list available plugins." ) else: table = PrettyTable() table.field_names = ( "Identifier", "Target Query Language", "Processing Pipeline Required", "Plugin", ) table.add_rows( [ ( name, fill(backend.name, width=60), "Yes" if backend.requires_pipeline else "No", _get_backend_plugin_id(backend), ) for name, backend in plugins.backends.items() ] ) table.align = "l" click.echo(table.get_string()) @list_group.command( name="formats", help="List formats supported by specified conversion backend." ) @click.argument( "backend", type=click.Choice(plugins.backends.keys()), ) def list_formats(backend): table = PrettyTable() table.field_names = ("Format", "Description") table.add_rows( [ (name, fill(description, width=60)) for name, description in plugins.backends[backend].formats.items() ] ) table.align = "l" click.echo(table.get_string()) @list_group.command( name="correlation-methods", help="List correlation methods supported by specified backend." ) @click.argument( "backend", type=click.Choice(plugins.backends.keys()), ) def list_correlation_methods(backend): correlation_methods = plugins.backends[backend].correlation_methods if correlation_methods is None: click.echo("No correlation supported by specified backend.") else: table = PrettyTable() table.field_names = ("Method", "Description") table.add_rows( [ (name, fill(description, width=60)) for name, description in correlation_methods.items() ] ) table.align = "l" click.echo(table.get_string()) @list_group.command(name="pipelines", help="List processing pipelines.") @click.argument("backend", required=False, type=click.Choice(plugins.backends.keys())) def list_pipelines(backend): pipeline_resolver = plugins.get_pipeline_resolver() pipelines = list(pipeline_resolver.list_pipelines()) if len(pipelines) == 0: click.echo( "No pipelines. Use " + click.style("sigma plugin list", bold=True, fg="green") + " to list available plugins." ) else: table = PrettyTable() table.field_names = ( "Identifier", "Priority", "Processing Pipeline", "Backends", "Plugin", ) for name, pipeline in pipelines: if ( backend is None or backend in pipeline.allowed_backends or len(pipeline.allowed_backends) == 0 ): if len(pipeline.allowed_backends) > 0: backends = ", ".join(pipeline.allowed_backends) else: backends = "all" table.add_row( ( name, pipeline.priority, fill(pipeline.name, width=60), backends, _pipeline_plugin_ids.get(name, "n/a"), ) ) table.align = "l" click.echo(table.get_string()) @list_group.command(name="validators", help="List rule validators.") def list_validators(): table = PrettyTable( field_names=( "Name", "Description", ), align="l", ) table.add_rows( [ (name, fill(dedent(validator.__doc__ or "-").strip(), width=60)) for name, validator in plugins.validators.items() ] ) click.echo(table.get_string()) @list_group.command(name="modifiers", help="List Sigma rule value modifiers.") def list_modifiers(): table = PrettyTable( field_names=( "Modifier", "Description", ), align="l", ) modifier_classes = [] for cls in modifier_mapping.values(): if not cls in modifier_classes: modifier_classes.append(cls) modifiers = [ ( " / ".join( modifier for modifier, c in modifier_mapping.items() if c == cls ), cls, ) for cls in modifier_classes ] table.add_rows( [ (modifier, fill(dedent(cls.__doc__ or "-").strip(), width=60)) for modifier, cls in modifiers # modifier_mapping.items() ] ) click.echo(table.get_string()) @list_group.command( name="transformations", help="List processing pipeline transformations." ) def list_transformations(): table = PrettyTable( field_names=( "Transformation", "Description", ), align="l", ) table.add_rows( [ (name, fill(dedent(cls.__doc__ or "-").strip(), width=60)) for name, cls in transformations.items() ] ) click.echo(table.get_string()) @list_group.command(name="conditions", help="List processing pipeline conditions.") def list_conditions(): table = PrettyTable( field_names=( "Type", "Condition", "Description", ), align="l", ) table.add_rows( [ ("Rule", name, fill(dedent(cls.__doc__ or "-").strip(), width=60)) for name, cls in rule_conditions.items() ] ) table.add_rows( [ ("Detection Item", name, fill(dedent(cls.__doc__ or "-").strip(), width=60)) for name, cls in detection_item_conditions.items() ] ) table.add_rows( [ ("Field Name", name, fill(dedent(cls.__doc__ or "-").strip(), width=60)) for name, cls in field_name_conditions.items() ] ) click.echo(table.get_string()) SigmaHQ-sigma-cli-f40f47a/sigma/cli/main.py000066400000000000000000000041201517101166100204240ustar00rootroot00000000000000import click import sys import requests from packaging.version import Version try: import sigma.parser.base click.echo( click.style("ERROR:", bold=True, fg="red") + click.style( " the legacy 'sigmatools' package is installed in the same Python environment as Sigma CLI and pySigma. This can cause unexpected errors!", fg="red", ) ) click.echo( click.style( "Please uninstall 'sigmatools' from this Python environment!", fg="red" ) ) click.echo( click.style( "It is strogly recommended to install Sigma CLI with pipx (https://pypa.github.io/pipx/) to ensure a clean environment.", fg="green", ) ) sys.exit(100) except ImportError: pass import importlib.metadata as metadata from .list import list_group from .convert import convert from .check import check from .plugin import plugin_group from .analyze import analyze_group from .pysigma import pysigma_group CONTEXT_SETTINGS={ "help_option_names": ['-h', '--help'] } @click.group(context_settings=CONTEXT_SETTINGS) def cli(): pass @click.command() def version(): """Print version of Sigma CLI.""" try: data = requests.get("https://pypi.org/pypi/sigma-cli/json").json() versions = list(data["releases"].keys()) versions.sort(key=Version, reverse=True) last_version = versions[0] except: last_version = "0.0.0" current_version = metadata.version("sigma-cli") if last_version == "0.0.0": click.echo(current_version) else: color = "green" if last_version == current_version else "red" click.echo( f"{current_version} (online pypi.org: " + click.style(last_version, bold=True, fg=color) + ")" ) def main(): cli.add_command(analyze_group) cli.add_command(plugin_group) cli.add_command(pysigma_group) cli.add_command(list_group) cli.add_command(convert) cli.add_command(check) cli.add_command(version) cli() if __name__ == "__main__": main() SigmaHQ-sigma-cli-f40f47a/sigma/cli/plugin.py000066400000000000000000000156061517101166100210110ustar00rootroot00000000000000from typing import List import click from sigma.plugins import ( SigmaPluginDirectory, SigmaPluginType, SigmaPluginState, SigmaPlugin, ) from sigma.exceptions import SigmaPluginNotFoundError from prettytable import PrettyTable from textwrap import fill from sigma.cli.pysigma import check_pysigma as check_pysigma_command @click.group( name="plugin", help="pySigma plugin management (backends, processing pipelines and validators).", ) def plugin_group(): pass @plugin_group.command(name="list", help="List installable plugins.") @click.option( "--plugin-type", "-t", type=click.Choice([str(item) for item in SigmaPluginType], case_sensitive=False), help="Display only plugins of given type.", ) @click.option( "--plugin-state", "-s", type=click.Choice([str(item) for item in SigmaPluginState], case_sensitive=False), help="Display only plugins with given state.", ) @click.option( "--compatible", "-c", is_flag=True, help="Show only plugins that are compatible with the installed pySigma version.", ) @click.argument("search", default="") def list_plugins(plugin_type: str, plugin_state: str, compatible: bool, search: str): plugins = SigmaPluginDirectory.default_plugin_directory() compatibility_state = { True: "yes", False: "no", None: "unknown", } get_plugins_args = dict() if plugin_type: get_plugins_args["plugin_types"] = {SigmaPluginType[plugin_type.upper()]} if plugin_state: get_plugins_args["plugin_states"] = {SigmaPluginState[plugin_state.upper()]} norm_search = search.lower() table = PrettyTable() table.field_names = ("Identifier", "Type", "State", "Description", "Compatible?", "Capabilities") table.add_rows( [ ( plugin.id, str(plugin.type), str(plugin.state), fill(plugin.description, width=60), compatibility_state[plugin.is_compatible()], len(plugin.capabilities), ) for plugin in plugins.get_plugins( compatible_only=compatible, **get_plugins_args ) if norm_search in plugin.id.lower() or norm_search in plugin.description.lower() ] ) table.align = "l" click.echo(table.get_string()) def get_plugin(uuid: bool, plugin_identifier: str) -> SigmaPlugin: plugins = SigmaPluginDirectory.default_plugin_directory() try: if uuid: return plugins.get_plugin_by_uuid(plugin_identifier) else: return plugins.get_plugin_by_id(plugin_identifier) except SigmaPluginNotFoundError as e: raise click.exceptions.ClickException(str(e)) # Display plugin details @plugin_group.command(name="show", help="Show details about plugin.") @click.option("--uuid", "-u", is_flag=True, help="Show plugin by UUID.") @click.argument("plugin-identifier") def show_plugin(uuid: bool, plugin_identifier: str): plugin = get_plugin(uuid, plugin_identifier) table = PrettyTable() table.field_names = ("Property", "Value") table.add_rows( [ ("Identifier", plugin.id), ("UUID", plugin.uuid), ("Type", str(plugin.type)), ("State", str(plugin.state)), ("Package", plugin.package), ("Description", fill(plugin.description, width=60)), ("Required pySigma version", plugin.pysigma_version), ("Compatible?", plugin.is_compatible()), ("Capabilities", "\n".join(str(capability) for capability in plugin.capabilities)), ("Project URL", plugin.project_url), ("Report Issue URL", plugin.report_issue_url), ] ) table.align = "l" click.echo(table.get_string()) @plugin_group.command(name="install", help="Install plugin by identifier or UUID.") @click.option("--uuid", "-u", is_flag=True, help="Install plugin by UUID.") @click.option( "--compatibility-check/--force-install", "-c/-f", default=True, help="Enable or disable plugin compatibility check.", ) @click.option( "--check-pysigma/--no-check-pysigma", "-l/-L", default=True, help="Check after plugin installation if pySigma version is still matching the CLI requirement.", ) @click.argument("plugin-identifiers", nargs=-1) def install_plugin( uuid: bool, compatibility_check: bool, check_pysigma: bool, plugin_identifiers: List[str] ): for plugin_identifier in plugin_identifiers: plugin = get_plugin(uuid, plugin_identifier) if not compatibility_check or plugin.is_compatible(): plugin.install() click.echo(f"Successfully installed plugin '{plugin_identifier}'") else: raise click.exceptions.ClickException( "Plugin not compatible with installed pySigma version! " + click.style("Use '--force-install' or its shortcut '-f' to install anyway.", fg="green") ) if check_pysigma: check_pysigma_command() @plugin_group.command(name="upgrade", help="Upgrade installed plugin.") @click.option( "--compatibility-check/--no-compatibility-check", "-c/-C", default=True, help="Enable or disable plugin compatibility check.", ) def upgrade_plugin(compatibility_check: bool): plugins_dir = SigmaPluginDirectory.default_plugin_directory() for plugin_id in plugins_dir.plugins: plugin = plugins_dir.get_plugin_by_uuid(uuid=plugin_id) if plugin.is_installed(): if not compatibility_check or plugin.is_compatible(): plugin.upgrade() click.echo(f"Successfully upgrade plugin '{plugin.id}'") else: click.echo( f"Plugin '{plugin.id}' not compatible with installed pySigma version" ) @plugin_group.command(name="uninstall", help="Uninstall plugin by identifier or UUID.") @click.option("--uuid", "-u", is_flag=True, help="Uninstall plugin by UUID.") @click.argument("plugin-identifiers", nargs=-1) def uninstall_plugin(uuid: bool, plugin_identifiers: List[str]): for plugin_identifier in plugin_identifiers: plugin = get_plugin(uuid, plugin_identifier) plugin.uninstall() click.echo(f"Successfully uninstalled plugin '{plugin_identifier}'") # Report issue in plugin by opening the issue reporting URL in the default browser @plugin_group.command( name="report-issue", help="Report issue in plugin by opening the issue reporting URL in the default browser.", ) @click.option("--uuid", "-u", is_flag=True, help="Report issue in plugin by UUID.") @click.argument("plugin-identifier") def report_issue(uuid: bool, plugin_identifier: str): plugin = get_plugin(uuid, plugin_identifier) if plugin.report_issue_url: click.launch(plugin.report_issue_url) else: raise click.exceptions.ClickException( "Plugin does not have an issue reporting URL!" ) SigmaHQ-sigma-cli-f40f47a/sigma/cli/pysigma.py000066400000000000000000000302101517101166100211500ustar00rootroot00000000000000import importlib.metadata import subprocess import sys import os from datetime import datetime import click from packaging.specifiers import SpecifierSet from prettytable import PrettyTable def get_cache_datasets(): from sigma.data import mitre_attack, mitre_d3fend return [ { 'key': 'mitre_attack', 'name': 'MITRE ATT&CK', 'module': mitre_attack, 'cache_key': 'mitre_attack_data_default', 'version_key': 'mitre_attack_version', 'trigger_attr': 'mitre_attack_techniques_tactics_mapping' }, { 'key': 'mitre_d3fend', 'name': 'MITRE D3FEND', 'module': mitre_d3fend, 'cache_key': 'mitre_d3fend_data_default', 'version_key': 'mitre_d3fend_version', 'trigger_attr': 'mitre_d3fend_techniques' } ] def parse_dataset_url_overrides(urls, datasets): dataset_names = {dataset['key'] for dataset in datasets} overrides = {} for url_override in urls: dataset_name, separator, dataset_url = url_override.partition(":") if not separator or not dataset_name or not dataset_url: raise click.BadParameter( "must use the format dataset:url", param_hint="--url", ) if dataset_name not in dataset_names: raise click.BadParameter( f"unknown dataset '{dataset_name}'. Available datasets: {', '.join(sorted(dataset_names))}", param_hint="--url", ) overrides[dataset_name] = dataset_url return overrides def get_pysigma_requirement(): requires = importlib.metadata.requires("sigma-cli") return [ r for r in requires if r.startswith("pysigma ") ][0] def check_pysigma_version(): """Check if the installed version of pysigma is compatible with the version required by sigma-cli.""" requires_pysgima = get_pysigma_requirement() version_specifier = SpecifierSet(requires_pysgima.split(" ")[1][1:-1]) return importlib.metadata.version("pysigma") in version_specifier @click.group( name="pysigma", help="pySigma library management commands." ) def pysigma_group(): pass @pysigma_group.command( name="check-version", help="Check if the installed version of pysigma is compatible with the version required by sigma-cli." ) @click.option( "--quiet/--no-quiet", "-q/-Q", default=False, help="Suppress output if check passes.", ) def check_version_command(quiet): check_pysigma(quiet) def check_pysigma(quiet=False): """Check the version of pySigma against the required version of sigma-cli and reinstall on user prompt if necessary.""" if check_pysigma_version(): if not quiet: click.echo(click.style("pySigma version is compatible with sigma-cli", fg="green")) else: click.echo(click.style("The currently installed pySigma version is not compatible with sigma-cli!", fg="red")) click.echo(click.style("Installed pySigma version: ", fg="yellow") + click.style(importlib.metadata.version("pysigma"), bold=True, fg="yellow")) click.echo(click.style("Required pySigma version: ", fg="yellow") + click.style(get_pysigma_requirement(), bold=True, fg="yellow")) click.echo("Usually the reason for this is that a backend with a different required pySigma version was installed.") click.echo("Because pySigma development aims to keep the API stable, it is likely that the backend is still working with the pySigma version required by sigma-cli.") click.echo("You have now two options:") click.echo("✅ Reinstall pySigma to match the pySigma version required by the CLI. This can break the functionality of the backend!") click.echo("❌ Ignore this warning and continue using the CLI. This can lead to unexpected behaviour or break other plugins that rely on current features.") if click.confirm("Do you want to reinstall pySigma now?"): subprocess.run( [ sys.executable, "-m", "pip", "install", "--quiet", "--upgrade", "--force-reinstall", get_pysigma_requirement(), ] ) click.echo("pySigma successfully reinstalled") else: click.echo("Incompatible pySigma version was keeped. You can rerun the check with: " + click.style("sigma pysigma check-version", fg="green")) @pysigma_group.command( name="list-cache", help="List cached data versions and timestamps." ) def list_cache_command(): """List the cached versions of pySigma data and their timestamps.""" try: datasets = get_cache_datasets() table = PrettyTable() table.field_names = ["Dataset", "Version", "Cached Date"] table.align = "l" for dataset in datasets: cache = dataset['module']._get_cache() # Check if cache directory exists and has the key if not os.path.exists(cache.directory) or dataset['cache_key'] not in cache: table.add_row([dataset['name'], "Not cached", "-"]) else: # Get cached data without triggering download data = cache.get(dataset['cache_key'], read=True) version = data.get(dataset['version_key'], 'Unknown') # Get timestamp from cache files cache_files = [f for f in os.listdir(cache.directory) if not f.startswith('.')] if cache_files: newest_mtime = max(os.path.getmtime(os.path.join(cache.directory, f)) for f in cache_files) timestamp = datetime.fromtimestamp(newest_mtime).strftime("%Y-%m-%d %H:%M:%S") else: timestamp = "Unknown" table.add_row([dataset['name'], version, timestamp]) click.echo(table) except ImportError: click.echo(click.style("Error: Unable to import pySigma data modules.", fg="red")) click.echo("Make sure pySigma is installed correctly.") except Exception as e: click.echo(click.style(f"Error accessing cache: {str(e)}", fg="red")) @pysigma_group.command( name="clear-cache", help="Delete all cached data." ) @click.option( "--yes", "-y", is_flag=True, help="Skip confirmation prompt.", ) def clear_cache_command(yes): """Delete the cached data for all datasets.""" try: datasets = get_cache_datasets() # Check what's cached cached_datasets = [] total_size = 0 total_entries = 0 for dataset in datasets: cache = dataset['module']._get_cache() if os.path.exists(cache.directory): keys = list(cache.iterkeys()) if keys: size = cache.volume() cached_datasets.append({ 'name': dataset['name'], 'entries': len(keys), 'size': size }) total_entries += len(keys) total_size += size if not cached_datasets: click.echo(click.style("No cached data found. Nothing to clear.", fg="yellow")) return # Confirm deletion if not yes: for cached in cached_datasets: click.echo(f"{cached['name']}: {cached['entries']} entries, {cached['size']} bytes") click.echo(f"Total: {total_entries} entries, {total_size} bytes") if not click.confirm(click.style("Are you sure you want to clear all cached data?", fg="yellow")): click.echo("Cache clearing cancelled.") return # Clear all caches cleared_count = 0 for dataset in datasets: cache = dataset['module']._get_cache() if os.path.exists(cache.directory): keys = list(cache.iterkeys()) if keys: dataset['module'].clear_cache() cleared_count += 1 click.echo(click.style(f"✓ Cache cleared successfully for {cleared_count} dataset(s).", fg="green")) click.echo(f"Removed {total_entries} cache entries ({total_size} bytes)") except ImportError: click.echo(click.style("Error: Unable to import pySigma data modules.", fg="red")) click.echo("Make sure pySigma is installed correctly.") except Exception as e: click.echo(click.style(f"Error clearing cache: {str(e)}", fg="red")) @pysigma_group.command( name="update-cache", help="Update cache by clearing and re-caching data." ) @click.option( "--yes", "-y", is_flag=True, help="Skip confirmation prompt.", ) @click.option( "--url", "urls", multiple=True, help="Override a dataset source in the format dataset:url.", ) def update_cache_command(yes, urls): """Update the cache by deleting it and re-caching data for all datasets.""" try: datasets = get_cache_datasets() url_overrides = parse_dataset_url_overrides(urls, datasets) for dataset in datasets: dataset_url = url_overrides.get(dataset['key']) if dataset_url is not None: dataset['module'].set_url(dataset_url) # Get current cache info cached_datasets = [] total_size = 0 total_entries = 0 for dataset in datasets: cache = dataset['module']._get_cache() if os.path.exists(cache.directory): keys = list(cache.iterkeys()) if keys: size = cache.volume() cached_datasets.append({ 'name': dataset['name'], 'entries': len(keys), 'size': size }) total_entries += len(keys) total_size += size # Confirm update if not yes: if cached_datasets: click.echo("Current cache:") for cached in cached_datasets: click.echo(f" {cached['name']}: {cached['entries']} entries, {cached['size']} bytes") click.echo(f"Total: {total_entries} entries, {total_size} bytes") else: click.echo("No cached data found (will download fresh data)") if not click.confirm(click.style("Update cache by clearing and re-downloading data?", fg="yellow")): click.echo("Cache update cancelled.") return # Clear and update each dataset updated_count = 0 new_total_size = 0 new_total_entries = 0 for dataset in datasets: click.echo(f"Updating {dataset['name']}...") # Clear cache dataset['module'].clear_cache() # Trigger re-caching by accessing data _ = getattr(dataset['module'], dataset['trigger_attr']) # Get new cache info cache = dataset['module']._get_cache() new_keys = list(cache.iterkeys()) new_size = cache.volume() click.echo(click.style(f" ✓ {dataset['name']} cached: {len(new_keys)} entries, {new_size} bytes", fg="green")) updated_count += 1 new_total_entries += len(new_keys) new_total_size += new_size click.echo() click.echo(click.style(f"✓ Cache updated successfully for {updated_count} dataset(s).", fg="green")) click.echo(f"Total: {new_total_entries} entries, {new_total_size} bytes") except ImportError: click.echo(click.style("Error: Unable to import pySigma data modules.", fg="red")) click.echo("Make sure pySigma is installed correctly.") except click.ClickException: raise except Exception as e: click.echo(click.style(f"Error updating cache: {str(e)}", fg="red"))SigmaHQ-sigma-cli-f40f47a/sigma/cli/rules.py000066400000000000000000000030561517101166100206410ustar00rootroot00000000000000from pathlib import Path from sys import stderr import click from sigma.collection import SigmaCollection def load_rules(input, file_pattern): """ Load Sigma rules from files or stdin. """ rule_collection = SigmaCollection([], []) for path in list(input): if path == Path("-"): rule_collection = SigmaCollection.merge([ rule_collection, SigmaCollection.from_yaml(click.get_text_stream("stdin")) ]) else: rule_paths = SigmaCollection.resolve_paths( [path], recursion_pattern="**/" + file_pattern, ) with click.progressbar( list(rule_paths), label="Parsing Sigma rules", file=stderr ) as progress_rule_paths: rule_collection = SigmaCollection.merge([ rule_collection, SigmaCollection.load_ruleset( progress_rule_paths, collect_errors=True, ) ]) rule_collection.resolve_rule_references() return rule_collection def check_rule_errors(sigma_collection): """ Check if the SigmaCollection contains errors and handle them. """ if sigma_collection.errors: click.echo("Errors found in Sigma rules:", err=True) for error in sigma_collection.errors: click.echo(f"* {error}", err=True) raise click.ClickException( "Errors found in Sigma rules. Please check the output above." )SigmaHQ-sigma-cli-f40f47a/tests/000077500000000000000000000000001517101166100164245ustar00rootroot00000000000000SigmaHQ-sigma-cli-f40f47a/tests/__init__.py000066400000000000000000000000001517101166100205230ustar00rootroot00000000000000SigmaHQ-sigma-cli-f40f47a/tests/files/000077500000000000000000000000001517101166100175265ustar00rootroot00000000000000SigmaHQ-sigma-cli-f40f47a/tests/files/custom_pipeline.yml000066400000000000000000000002561517101166100234530ustar00rootroot00000000000000name: Custom Pipeline priority: 100 transformations: - id: field_mapping type: field_name_mapping mapping: ParentImage: some_other_string User: usernameSigmaHQ-sigma-cli-f40f47a/tests/files/invalid/000077500000000000000000000000001517101166100211545ustar00rootroot00000000000000SigmaHQ-sigma-cli-f40f47a/tests/files/invalid/sigma_rule_with_condition_errors.yml000066400000000000000000000003671517101166100305310ustar00rootroot00000000000000title: Test rule id: 5013332f-8a70-4e04-bcc1-06a98a2cca2e logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: '\httpd.exe' Image|endswith: '\cmd.exe' condition: selection | count() > 5SigmaHQ-sigma-cli-f40f47a/tests/files/invalid/sigma_rule_with_errors.yml000066400000000000000000000002421517101166100264530ustar00rootroot00000000000000title: Test id: invalid level: invalid status: invalid date: invalid detections: detection: selection_1: Image|test: test.exe condition: selectionSigmaHQ-sigma-cli-f40f47a/tests/files/issues/000077500000000000000000000000001517101166100210415ustar00rootroot00000000000000SigmaHQ-sigma-cli-f40f47a/tests/files/issues/sigma_rule_wildcards_instead_of_endswith.yml000066400000000000000000000003311517101166100320440ustar00rootroot00000000000000title: Test rule id: 5013332f-8a70-4e04-bcc1-06a98a2cca2e logsource: category: process_creation product: windows detection: selection: ParentImage: '*\httpd.exe' Image: '*\cmd.exe' condition: selectionSigmaHQ-sigma-cli-f40f47a/tests/files/issues/sigma_rule_with_bad_references.yml000066400000000000000000000004631517101166100277600ustar00rootroot00000000000000title: Test rule id: 5013332f-8a70-4e04-bcc1-06a911111111 related: - id: 5013332f-8a70-4e04-bcc1-06a911111112 type: Something logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: '\httpd.exe' Image|endswith: '\cmd.exe' condition: selectionSigmaHQ-sigma-cli-f40f47a/tests/files/issues/sigma_rule_without_id.yml000066400000000000000000000003001517101166100261430ustar00rootroot00000000000000title: Test rule logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: '\httpd.exe' Image|endswith: '\cmd.exe' condition: selectionSigmaHQ-sigma-cli-f40f47a/tests/files/sigma_correlation_rules.yml000066400000000000000000000035041517101166100251660ustar00rootroot00000000000000title: Base rule description: This is a base rule id: 5d8fd9da-6916-45ef-8d4d-3fa9d19d1a64 name: base_rule status: test level: informational date: 2023-12-09 logsource: category: test detection: selection: fieldA: value1 fieldB: value2 condition: selection --- title: Multiple occurrences of base event description: This is a correlation rule id: 4db3cdb5-aac6-4827-a756-d99475865d32 status: test level: medium date: 2023-12-09 correlation: type: event_count rules: - base_rule group-by: - fieldC - fieldD timespan: 15m condition: gte: 10 --- title: Multiple occurrences of base event with different values description: This is a correlation rule id: 16a288b8-4ed2-440f-9984-7a128e86e006 date: 2023-12-09 status: test level: medium correlation: type: value_count rules: - base_rule group-by: - fieldC timespan: 15m condition: lt: 10 field: fieldD --- title: Base rule 1 description: This is a base rule id: 73a9addc-0cf9-44a4-ad18-e3b7a9d1eeb4 name: base_rule_1 date: 2023-12-09 status: test level: informational logsource: category: test detection: selection: fieldA: value1 fieldB: value2 condition: selection --- title: Base rule 2 description: This is a base rule id: fce9c855-2951-4e96-b764-dbc1dfdf4993 name: base_rule_2 date: 2023-12-09 status: test level: informational logsource: category: test detection: selection: fieldA: value3 fieldB: value4 condition: selection --- title: Temporal correlation rule description: This is a correlation rule id: dc48f97e-237d-42f4-a136-39c94cd53a17 date: 2023-12-09 status: test level: high correlation: type: temporal rules: - base_rule_1 - base_rule_2 group-by: - fieldC timespan: 15mSigmaHQ-sigma-cli-f40f47a/tests/files/sigma_filter.yml000066400000000000000000000007431517101166100227220ustar00rootroot00000000000000title: Filter Out Administrator account description: The valid administrator account start with adm_ logsource: category: process_creation product: windows filter: rules: - 5013332f-8a70-4e04-bcc1-06a98a2cca2e - 6f3e2987-db24-4c78-a860-b4f4095a7095 # Data Compressed - rar.exe - df0841c0-9846-4e9f-ad8a-7df91571771b # Login on jump host - 5d8fd9da-6916-45ef-8d4d-3fa9d19d1a64 # Base rule selection: User|startswith: "ADM_" condition: not selectionSigmaHQ-sigma-cli-f40f47a/tests/files/sigma_rule_without_condition.yml000066400000000000000000000002401517101166100262250ustar00rootroot00000000000000title: Rule without condition id: cb83ea64-fc69-479e-9c99-aaaaaaaaaaaa logsource: category: test detection: selection: field: value condition: selectionSigmaHQ-sigma-cli-f40f47a/tests/files/valid/000077500000000000000000000000001517101166100206255ustar00rootroot00000000000000SigmaHQ-sigma-cli-f40f47a/tests/files/valid/sigma_rule.yml000066400000000000000000000005201517101166100234740ustar00rootroot00000000000000title: Test rule id: 5013332f-8a70-4e04-bcc1-06a98a2cca2e description: it is a valid rule status: stable level: high date: 2023-12-09 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: '\httpd.exe' Image|endswith: '\cmd.exe' condition: selection tags: - attack.t1505.003SigmaHQ-sigma-cli-f40f47a/tests/files/validation_config.yml000066400000000000000000000002111517101166100237220ustar00rootroot00000000000000validators: - all - -tlptag - -tlpv1_tag exclusions: 5013332f-8a70-4e04-bcc1-06a98a2cca2e: wildcards_instead_of_modifiersSigmaHQ-sigma-cli-f40f47a/tests/test_analyze.py000066400000000000000000000172051517101166100215050ustar00rootroot00000000000000import pytest from click.testing import CliRunner from sigma.cli.analyze import analyze_group, analyze_attack, analyze_logsource, analyze_fields from sigma.rule import ( SigmaRule, SigmaLogSource, SigmaDetections, SigmaDetection, SigmaDetectionItem, SigmaLevel, SigmaRuleTag, ) from sigma.types import SigmaString from sigma.analyze.attack import ( calculate_attack_scores, score_count, score_max, score_level, rule_level_scores, score_functions, ) from sigma.analyze.stats import create_logsourcestats, get_rulelevel_mapping, format_row def test_analyze_group(): cli = CliRunner() result = cli.invoke(analyze_group, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 8 def test_attack_help(): cli = CliRunner() result = cli.invoke(analyze_attack, ["--help"]) assert result.exit_code == 0 for func in score_functions.keys(): assert func in result.stdout assert len(result.stdout.split()) > 8 def test_attack_generate(): cli = CliRunner() result = cli.invoke(analyze_attack, ["max", "-", "tests/files/valid"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 25 assert "T1505.003" in result.stdout assert "persistence" in result.stdout assert "#ff0000" in result.stdout assert "#ffffff00" in result.stdout assert '"maxValue": 4' in result.stdout assert '"minValue": 0' in result.stdout def test_attack_generate_max_value(): cli = CliRunner() result = cli.invoke( analyze_attack, ["--max-score", "2", "max", "-", "tests/files/valid"] ) assert result.exit_code == 0 assert '"maxValue": 2' in result.stdout def test_attack_generate_min_value(): cli = CliRunner() result = cli.invoke( analyze_attack, ["--min-score", "2", "max", "-", "tests/files/valid"] ) assert result.exit_code == 0 assert '"minValue": 2' in result.stdout def test_attack_generate_max_color(): cli = CliRunner() result = cli.invoke( analyze_attack, ["--max-color", "#123456", "max", "-", "tests/files/valid"] ) assert result.exit_code == 0 assert "#123456" in result.stdout def test_attack_generate_min_color(): cli = CliRunner() result = cli.invoke( analyze_attack, ["--min-color", "#123456", "max", "-", "tests/files/valid"] ) assert result.exit_code == 0 assert "#123456" in result.stdout def test_attack_generate_no_subtechniques(): cli = CliRunner() result = cli.invoke( analyze_attack, ["--no-subtechniques", "max", "-", "tests/files/valid"] ) assert result.exit_code == 0 assert len(result.stdout.split()) > 25 assert 'T1505"' in result.stdout assert "persistence" in result.stdout def test_attack_invalid_rule(): cli = CliRunner() result = cli.invoke(analyze_attack, ["max", "-", "tests/files/sigma_rule_without_condition.yml"]) assert result.exit_code != 0 assert "at least one condition" in result.stderr @pytest.fixture def sigma_rules(): logsource = SigmaLogSource(category="test") detections = SigmaDetections( {"test": SigmaDetection([SigmaDetectionItem("field", [], [SigmaString("value")])])}, ["test"] ) return [ SigmaRule( title="Medium severity rule", logsource=logsource, detection=detections, level=SigmaLevel.MEDIUM, tags=[SigmaRuleTag("test", "tag"), SigmaRuleTag("attack", "t1234.001")], ), SigmaRule( title="None severity rule", logsource=logsource, detection=detections, tags=[SigmaRuleTag("attack", "t1234.001")], ), SigmaRule( title="Low severity rule", logsource=logsource, detection=detections, level=SigmaLevel.LOW, ), SigmaRule( title="Critical severity rule", logsource=logsource, detection=detections, level=SigmaLevel.CRITICAL, tags=[SigmaRuleTag("attack", "t4321")], ), SigmaRule( title="Informational severity rule", logsource=logsource, detection=detections, level=SigmaLevel.INFORMATIONAL, tags=[SigmaRuleTag("attack", "t4321")], ), SigmaRule( title="High severity rule", logsource=logsource, detection=detections, level=SigmaLevel.HIGH, tags=[SigmaRuleTag("attack", "t4321")], ), ] def test_attack_score_count(sigma_rules): assert score_count(sigma_rules) == 6 def test_attack_score_max(sigma_rules): assert score_max(sigma_rules) == 5 def test_attack_score_level(sigma_rules): assert score_level(sigma_rules) == sum(rule_level_scores.values()) def test_generate_attack_scores(sigma_rules): assert calculate_attack_scores(sigma_rules, score_count) == { "T1234.001": 2, "T4321": 3, } def test_generate_attack_scores_no_subtechniques(sigma_rules): assert calculate_attack_scores(sigma_rules, score_count, True) == { "T1234": 2, "T4321": 3, } def test_logsource_help(): cli = CliRunner() result = cli.invoke(analyze_logsource, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 8 def test_logsource_get_rulelevel_mapping(sigma_rules): for sigma_rule in sigma_rules: if sigma_rule.level: assert ( str(get_rulelevel_mapping(sigma_rule)).lower() == sigma_rule.level.name.lower() ) else: assert str(get_rulelevel_mapping(sigma_rule)).lower() == "none" def test_logsource_create_logsourcestats(sigma_rules): ret = create_logsourcestats(sigma_rules) assert 'test' in ret assert ret['test'].get("Overall") == len(sigma_rules) def test_logsource_invalid_rule(): cli = CliRunner() result = cli.invoke(analyze_logsource, ["-", "tests/files/sigma_rule_without_condition.yml"]) assert result.exit_code != 0 assert "at least one condition" in result.stderr def test_fields_help(): cli = CliRunner() result = cli.invoke(analyze_fields, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 8 def test_fields_extract(): cli = CliRunner() result = cli.invoke(analyze_fields, ["-t", "text_query_test", "-", "tests/files/valid"]) assert result.exit_code == 0 # Should have extracted at least some fields assert len(result.stdout.split()) > 0 def test_fields_extract_correlation_rule(): cli = CliRunner() result = cli.invoke(analyze_fields, ["-t", "text_query_test", "-", "tests/files/sigma_correlation_rules.yml"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 0 def test_fields_extract_with_pipelines(): cli = CliRunner() result = cli.invoke(analyze_fields, ["-t", "text_query_test", "-p", "tests/files/custom_pipeline.yml", "-p", "dummy_test", "-", "tests/files/valid"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 0 def test_fields_invalid_rule(): cli = CliRunner() result = cli.invoke(analyze_fields, ["-t", "text_query_test", "-", "tests/files/sigma_rule_without_condition.yml"]) assert result.exit_code != 0 assert "at least one condition" in result.stderr def test_fields_grouped_extract(): cli = CliRunner() result = cli.invoke(analyze_fields, ["-t", "text_query_test", "--group", "-", "tests/files/valid"]) assert result.exit_code == 0 # Should have extracted at least some fields assert len(result.stdout.split()) > 0 assert "+----------" in result.stdout # Check for table formatSigmaHQ-sigma-cli-f40f47a/tests/test_check.py000066400000000000000000000046311517101166100211160ustar00rootroot00000000000000from click.testing import CliRunner from sigma.cli.check import check def test_check_help(): cli = CliRunner() result = cli.invoke(check, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 20 def test_check_valid(): cli = CliRunner() result = cli.invoke(check, ["tests/files/valid"]) assert result.exit_code == 0 assert "0 errors" in result.stdout assert "0 condition errors" in result.stdout assert "0 issues" in result.stdout def test_check_stdin(): cli = CliRunner() with open("tests/files/valid/sigma_rule.yml", "rt") as yml_file: input = yml_file.read() result = cli.invoke(check, ["-"], input=input) assert result.exit_code == 0 assert "0 errors" in result.stdout assert "0 condition errors" in result.stdout assert "0 issues" in result.stdout def test_check_invalid(): cli = CliRunner() result = cli.invoke(check, ["tests/files/invalid"]) assert result.exit_code == 1 assert "6 errors" in result.stdout assert "1 condition errors" in result.stdout assert "0 issues" in result.stdout def test_check_with_issues(): cli = CliRunner() result = cli.invoke(check, ["tests/files/issues"]) assert result.exit_code == 1 assert "4 issues" in result.stdout def test_check_with_issues_exclusions(): cli = CliRunner() result = cli.invoke( check, [ "--validation-config", "tests/files/validation_config.yml", "tests/files/issues", ], ) assert result.exit_code == 1 assert "2 issues" in result.stdout def test_check_fail_on_issues(): cli = CliRunner() result = cli.invoke(check, ["--fail-on-issues", "tests/files/issues"]) assert result.exit_code == 1 assert "Validation issue summary" in result.stdout def test_check_exclude(): cli = CliRunner() result = cli.invoke( check, [ "--fail-on-issues", "--exclude", "Invalid_Related_Type", "--exclude", "status_existence", "-x", "date_existence", "--exclude", "MyValidator", "tests/files/issues/sigma_rule_with_bad_references.yml", ], ) assert result.exit_code == 1 assert "Invalid validators name" in result.stdout assert "myvalidator" in result.stdout assert "Check failure" in result.stdout SigmaHQ-sigma-cli-f40f47a/tests/test_convert.py000066400000000000000000000170111517101166100215150ustar00rootroot00000000000000from click.testing import CliRunner import pytest from sigma.cli.convert import convert import sigma.backends.test.backend def test_convert_help(): cli = CliRunner() result = cli.invoke(convert, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 20 def test_convert_output_list_of_str(): cli = CliRunner() result = cli.invoke( convert, [ "-t", "text_query_test", "-p", "another_test", "--disable-pipeline-check", "tests/files/valid", ], ) assert ( 'EventID=1 and ParentImage endswith "\\httpd.exe" and Image endswith "\\cmd.exe"' in result.stdout ) def test_convert_invalid_rule(): cli = CliRunner() result = cli.invoke( convert, [ "-t", "text_query_test", "-p", "another_test", "--disable-pipeline-check", "tests/files/sigma_rule_without_condition.yml", ], ) assert result.exit_code > 0 assert "at least one condition" in result.stderr def test_convert_stdin(): cli = CliRunner() with open("tests/files/valid/sigma_rule.yml", "rt") as yml_file: input = yml_file.read() result = cli.invoke( convert, [ "-t", "text_query_test", "-p", "another_test", "--disable-pipeline-check", "-", ], input=input, ) assert ( 'EventID=1 and ParentImage endswith "\\httpd.exe" and Image endswith "\\cmd.exe"' in result.stdout ) def test_convert_output_list_of_dict(): cli = CliRunner() result = cli.invoke( convert, ["-t", "text_query_test", "-f", "list_of_dict", "tests/files/valid"] ) assert "ParentImage" in result.stdout def test_convert_output_list_of_dict_indent(): cli = CliRunner() result_noindent = cli.invoke( convert, ["-t", "text_query_test", "-f", "list_of_dict", "tests/files/valid"] ) result_indent = cli.invoke( convert, ["-t", "text_query_test", "-f", "list_of_dict", "-j", "2", "tests/files/valid"], ) assert len(result_indent.stdout.split("\n")) > len( result_noindent.stdout.split("\n") ) def test_convert_output_str(): cli = CliRunner() result = cli.invoke( convert, ["-t", "text_query_test", "-f", "str", "-c", "test", "tests/files/valid"] ) assert "ParentImage" in result.stdout # The following test is hard to implement: in a terminal it behaves as expected, as test it seems to be # something different. The outcome if this fails is also non-fatal: the user gets some binary output on a tty. # Therefore, the test is not implemented for now. """ def test_convert_output_bytes_without_output(monkeypatch): monkeypatch.setattr("click._io.IOBase", "isatty", lambda self: True) cli = CliRunner() result = cli.invoke(convert, ["-t", "qradar", "-f", "extension", "tests/files/valid"]) assert "provide output file" in result.stdout """ def test_convert_output_bytes(tmp_path): cli = CliRunner() test_file = tmp_path / "test.bin" result = cli.invoke( convert, [ "-t", "text_query_test", "-f", "bytes", "-o", str(test_file), "tests/files/valid", ], ) assert result.exit_code == 0 assert "ParentImage" in open(test_file, "r").read() def test_convert_unknown_backend(): cli = CliRunner() result = cli.invoke( convert, ["-t", "notexisting", "-f", "foo", "tests/files/valid"] ) assert "Invalid value for" in result.stderr assert "--plugin-type backend" in result.stderr def test_convert_unknown_format(): cli = CliRunner() result = cli.invoke( convert, ["-t", "text_query_test", "-f", "nonexisting", "tests/files/valid"] ) assert "Invalid value for format" in result.stderr assert "sigma list formats" in result.stderr def test_convert_unknown_pipeline(): cli = CliRunner() result = cli.invoke( convert, ["-t", "text_query_test", "-p", "nonexisting", "tests/files/valid"] ) assert "'nonexisting' was not found" in result.stderr assert "--plugin-type pipeline" in result.stderr def test_convert_missing_input(): cli = CliRunner() result = cli.invoke(convert, ["-t", "text_query_test"]) assert "Missing argument" in result.stderr def test_convert_missing_pipeline(): cli = CliRunner() result = cli.invoke(convert, ["-t", "mandatory_pipeline_test", "tests/files/valid"]) assert result.exit_code > 0 and "pipeline required" in result.stderr def test_convert_missing_pipeline_ignore(): cli = CliRunner() result = cli.invoke( convert, ["-t", "mandatory_pipeline_test", "--without-pipeline", "tests/files/valid"], ) assert "ParentImage" in result.stdout def test_convert_wrong_pipeline(): cli = CliRunner() result = cli.invoke( convert, ["-t", "text_query_test", "-p", "another_test", "tests/files/valid"] ) assert result.exit_code > 0 and "'another_test' is not intended" in result.stderr def test_yml_pipeline_doesnt_trigger_wrong_pipeline(): cli = CliRunner() result = cli.invoke( convert, [ "-t", "text_query_test", "-p", "dummy_test", "-p", "tests/files/custom_pipeline.yml", "tests/files/valid", ], ) assert "some_other_string" in result.stdout def test_backend_option_invalid_format(): cli = CliRunner() result = cli.invoke( convert, ["-t", "text_query_test", "-O", "invalid", "tests/files/valid"] ) assert result.exit_code != 0 assert "not format key=value" in result.stderr def test_backend_option_invalid_type(): cli = CliRunner() result = cli.invoke( convert, ["-t", "text_query_test", "-O", 123, "tests/files/valid"] ) assert result.exit_code != 0 assert "must be a string" in result.stderr def test_convert_output_backend_option(): cli = CliRunner() result = cli.invoke( convert, [ "-t", "text_query_test", "-f", "list_of_dict", "-O", "testparam=testvalue", "tests/files/valid", ], ) assert "testvalue" in result.stdout def test_convert_output_backend_option_list(): cli = CliRunner() result = cli.invoke( convert, [ "-t", "text_query_test", "-f", "list_of_dict", "-O", "testparam=123", "-O", "testparam=test", "tests/files/valid", ], ) assert '[123, "test"]' in result.stdout def test_convert_correlation_method_without_backend_correlation_support(monkeypatch): monkeypatch.setattr(sigma.backends.test.backend.TextQueryTestBackend, "correlation_methods", None) cli = CliRunner() result = cli.invoke( convert, ["-t", "text_query_test", "-f", "str", "-c", "test", "tests/files/valid"] ) assert result.exit_code != 0 assert "Backend 'text_query_test' does not support correlation" in result.stderr def test_convert_invalid_correlation_method(): cli = CliRunner() result = cli.invoke( convert, ["-t", "text_query_test", "-f", "str", "-c", "invalid", "tests/files/valid"] ) assert result.exit_code != 0 assert "Correlation method 'invalid' is not supported" in result.stderrSigmaHQ-sigma-cli-f40f47a/tests/test_filters.py000066400000000000000000000037631517101166100215160ustar00rootroot00000000000000from click.testing import CliRunner from sigma.cli.convert import convert def test_filter_basic_operation(): cli = CliRunner() result = cli.invoke( convert, ["-t", "text_query_test", "--filter", "tests/files/sigma_filter.yml", "tests/files/valid/sigma_rule.yml"], ) assert 'ParentImage endswith "\\httpd.exe" and Image endswith "\\cmd.exe" and not User startswith "ADM_"\n' in result.stdout def test_filter_basic_from_stdin(): cli = CliRunner() with open("tests/files/valid/sigma_rule.yml", "rt") as yml_file: input = yml_file.read() result = cli.invoke( convert, [ "-t", "text_query_test", "--filter", "tests/files/sigma_filter.yml", "-", ], input=input, ) assert ( 'ParentImage endswith "\\httpd.exe" and Image endswith "\\cmd.exe" and not User startswith "ADM_"\n' in result.stdout ) def test_filter_with_pipeline_mapping(): cli = CliRunner() result = cli.invoke( convert, [ "-t", "text_query_test", "-p", "tests/files/custom_pipeline.yml", "--filter", "tests/files/sigma_filter.yml", "tests/files/valid/sigma_rule.yml" ], ) assert 'some_other_string endswith "\\httpd.exe" and Image endswith "\\cmd.exe" and not username startswith "ADM_"\n' in result.stdout # def test_filter_with_correlation_rules(): # cli = CliRunner( # mix_stderr=True # ) # result = cli.invoke( # convert, [ # # "-t", # "text_query_test", # "-p", # "tests/files/custom_pipeline.yml", # "--filter", # "tests/files/sigma_filter.yml", # "./tests/files/valid/sigma_correlation_rules.yml" # ], # ) # # assert 'some_other_string endswith "\\httpd.exe" and Image endswith "\\cmd.exe" and not username startswith "ADM_"\n' in result.stdout SigmaHQ-sigma-cli-f40f47a/tests/test_lists.py000066400000000000000000000101101517101166100211640ustar00rootroot00000000000000from typing import Counter import pytest from click.testing import CliRunner from sigma.cli.list import ( list_correlation_methods, list_group, list_pipelines, list_targets, list_formats, list_validators, list_modifiers, list_transformations, list_conditions, ) from sigma.plugins import InstalledSigmaPlugins from sigma.modifiers import modifier_mapping from sigma.processing.transformations import transformations from sigma.processing.conditions import ( rule_conditions, detection_item_conditions, field_name_conditions, ) def test_list_help(): cli = CliRunner() result = cli.invoke(list_group, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 20 def test_list_pipelines_help(): cli = CliRunner() result = cli.invoke(list_pipelines, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 5 def test_list_targets_help(): cli = CliRunner() result = cli.invoke(list_targets, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 5 def test_list_formats_help(): cli = CliRunner() result = cli.invoke(list_formats, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 5 def test_list_validators_help(): cli = CliRunner() result = cli.invoke(list_validators, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 5 @pytest.fixture(params=[list_targets, list_pipelines], ids=["targets", "pipelines"]) def cli_list(request): cli = CliRunner() yield cli.invoke(request.param) def test_simple_list(cli_list): counts = Counter(cli_list.output) assert ( cli_list.exit_code == 0 and len(cli_list.output.split()) >= 5 and counts["|"] >= 6 and counts["-"] >= 40 ) def test_format_list(): cli = CliRunner() cli_list = cli.invoke(list_formats, ["text_query_test"]) counts = Counter(cli_list.output) assert ( cli_list.exit_code == 0 and len(cli_list.output.split()) >= 5 and counts["|"] >= 6 and counts["-"] >= 40 ) def test_corelation_methods_list(): cli = CliRunner() cli_list = cli.invoke(list_correlation_methods, ["text_query_test"]) counts = Counter(cli_list.output) assert ( cli_list.exit_code == 0 and len(cli_list.output.split()) >= 5 and counts["|"] >= 6 and counts["-"] >= 40 ) def test_pipeline_list_with_backend(): cli = CliRunner() list_all = cli.invoke(list_pipelines).stdout.split("\n") list_filtered = cli.invoke(list_pipelines, ["test"]).stdout.split("\n") assert len(list_all) > len(list_filtered) def test_validator_list(): cli = CliRunner() plugins = InstalledSigmaPlugins.autodiscover() validators = plugins.validators result = cli.invoke(list_validators) assert len(result.stdout.split()) > 10 assert all( (validator_name in result.stdout for validator_name in validators.keys()) ) def test_modifier_list(): cli = CliRunner() result = cli.invoke(list_modifiers) assert all((name in result.stdout for name in modifier_mapping.keys())) def test_transformation_list(): cli = CliRunner() result = cli.invoke(list_transformations) assert all((name in result.stdout for name in transformations.keys())) def test_targets_has_plugin_column(): cli = CliRunner() result = cli.invoke(list_targets) assert result.exit_code == 0 assert "Plugin" in result.stdout # Each row should show a non-empty package name (not "n/a") for installed backends. plugins = InstalledSigmaPlugins.autodiscover() if plugins.backends: assert "n/a" not in result.stdout def test_pipelines_has_plugin_column(): cli = CliRunner() result = cli.invoke(list_pipelines) assert result.exit_code == 0 assert "Plugin" in result.stdout # Each row should show a non-empty package name (not "n/a") for installed pipelines. plugins = InstalledSigmaPlugins.autodiscover() if plugins.pipelines: assert "n/a" not in result.stdout SigmaHQ-sigma-cli-f40f47a/tests/test_main.py000066400000000000000000000006451517101166100207660ustar00rootroot00000000000000from sigma.cli.main import cli as main, version from click.testing import CliRunner import re def test_help(): cli = CliRunner() result = cli.invoke(main, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 10 def test_version(): cli = CliRunner() result = cli.invoke(version) assert result.exit_code == 0 assert re.search("\\d+\\.\\d+\\.\\d+", result.stdout) SigmaHQ-sigma-cli-f40f47a/tests/test_plugin.py000066400000000000000000000061441517101166100213400ustar00rootroot00000000000000from click.testing import CliRunner from sigma.cli.plugin import ( plugin_group, list_plugins, install_plugin, uninstall_plugin, ) def test_plugin_help(): cli = CliRunner() result = cli.invoke(plugin_group, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 20 def test_plugin_list_help(): cli = CliRunner() result = cli.invoke(list_plugins, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 20 def test_plugin_install_help(): cli = CliRunner() result = cli.invoke(install_plugin, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 20 def test_plugin_uninstall_help(): cli = CliRunner() result = cli.invoke(uninstall_plugin, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 20 def test_plugin_list(): cli = CliRunner() plugin_list = cli.invoke(list_plugins) assert plugin_list.exit_code == 0 assert len(plugin_list.output.split()) > 10 def test_plugin_list_filtered(): cli = CliRunner() plugin_list = cli.invoke(list_plugins) plugin_list_filtered = cli.invoke(list_plugins, ["-t", "backend", "-s", "stable"]) assert plugin_list.exit_code == 0 assert plugin_list_filtered.exit_code == 0 assert len(plugin_list.output.split()) > len(plugin_list_filtered.output.split()) def test_plugin_list_search(): cli = CliRunner() plugin_list = cli.invoke(list_plugins) plugin_list_search = cli.invoke(list_plugins, ["Sysmon"]) assert plugin_list.exit_code == 0 assert plugin_list_search.exit_code == 0 assert len(plugin_list.output.split()) > len(plugin_list_search.output.split()) def test_plugin_show_help(): cli = CliRunner() result = cli.invoke(plugin_group, ["show", "--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 20 def test_plugin_show_identifier(): cli = CliRunner() plugin_show = cli.invoke(plugin_group, ["show", "splunk"]) assert plugin_show.exit_code == 0 assert "Splunk" in plugin_show.output def test_plugin_show_nonexisting(): cli = CliRunner() plugin_show = cli.invoke(plugin_group, ["show", "notexisting"]) assert plugin_show.exit_code != 0 assert "error" in plugin_show.output.lower() def test_plugin_show_uuid(): cli = CliRunner() plugin_show = cli.invoke( plugin_group, ["show", "-u", "4af37b53-f1ec-4567-8017-2fb9315397a1"] ) assert plugin_show.exit_code == 0 assert "Splunk" in plugin_show.output def test_plugin_install_notexisting(): cli = CliRunner() result = cli.invoke(install_plugin, ["notexisting"]) assert result.exit_code != 0 assert "error" in result.output.lower() def test_plugin_install(): cli = CliRunner() result = cli.invoke(install_plugin, ["-f", "splunk"]) assert result.exit_code == 0 assert "Successfully installed" in result.output def test_plugin_uninstall(): cli = CliRunner() result = cli.invoke(uninstall_plugin, ["splunk"]) assert result.exit_code == 0 assert "Successfully uninstalled" in result.output SigmaHQ-sigma-cli-f40f47a/tests/test_pysigma.py000066400000000000000000000154571517101166100215220ustar00rootroot00000000000000import importlib import re import sys import types from sigma.cli.pysigma import pysigma_group, check_pysigma_version from click.testing import CliRunner import pytest @pytest.mark.xfail( condition=re.match(r"^\d+\.\d+\.\d+\w+\d+$", importlib.metadata.version("pysigma")), reason="pysigma version is release candidate or other special version.", ) def test_check_pysigma_version(): assert check_pysigma_version() == True @pytest.mark.parametrize( "pysigma_expected_version,pysigma_installed_version,expected_result", [ ("<0.11.0,>=0.10.4", "0.10.4", True), ("<0.11.0,>=0.10.4", "0.11.0", False), ("<0.11.0,>=0.10.4", "0.10.3", False), ] ) def test_check_pysigma_version_incompatible(monkeypatch, pysigma_expected_version, pysigma_installed_version, expected_result): monkeypatch.setattr('importlib.metadata.requires', lambda x: [f'pysigma ({pysigma_expected_version})']) monkeypatch.setattr('importlib.metadata.version', lambda x: pysigma_installed_version) assert check_pysigma_version() == expected_result @pytest.mark.xfail( condition=re.match(r"^\d+\.\d+\.\d+\w+\d+$", importlib.metadata.version("pysigma")), reason="pysigma version is release candidate or other special version.", ) def test_check_pysigma(): cli = CliRunner() result = cli.invoke(pysigma_group, ["check-version"]) assert "pySigma version is compatible with sigma-cli" in result.output @pytest.mark.skip(reason="This test is not working") def test_check_pysigma_incompatible(monkeypatch): monkeypatch.setattr('importlib.metadata.version', lambda x: "0.0.1") cli = CliRunner() result = cli.invoke(pysigma_group, ["check-version"], input="y\n") assert "pySigma version is not compatible" in result.output assert "pySigma successfully reinstalled" in result.output def test_list_cache(): """Test list-cache command shows cache information.""" cli = CliRunner() result = cli.invoke(pysigma_group, ["list-cache"]) assert result.exit_code == 0 # Check that the output contains the expected table headers and dataset names assert "Dataset" in result.output assert "Version" in result.output assert "Cached Date" in result.output assert ("MITRE ATT&CK" in result.output or "Not cached" in result.output) def test_clear_cache_help(): """Test clear-cache command help.""" cli = CliRunner() result = cli.invoke(pysigma_group, ["clear-cache", "--help"]) assert result.exit_code == 0 assert "Delete all cached data" in result.output assert "--yes" in result.output or "-y" in result.output def test_clear_cache_with_confirmation_cancel(): """Test clear-cache command cancellation.""" cli = CliRunner() result = cli.invoke(pysigma_group, ["clear-cache"], input="n\n") assert result.exit_code == 0 assert "cancelled" in result.output.lower() or "empty" in result.output.lower() or "nothing to clear" in result.output.lower() or "No cache directory found" in result.output def test_clear_cache_with_yes_flag(): """Test clear-cache command with -y flag.""" cli = CliRunner() result = cli.invoke(pysigma_group, ["clear-cache", "-y"]) assert result.exit_code == 0 assert "cleared" in result.output.lower() or "empty" in result.output.lower() or "nothing to clear" in result.output.lower() or "No cache directory found" in result.output def test_update_cache_help(): """Test update-cache command help.""" cli = CliRunner() result = cli.invoke(pysigma_group, ["update-cache", "--help"]) assert result.exit_code == 0 assert "Update cache" in result.output assert "--yes" in result.output or "-y" in result.output assert "--url" in result.output def test_update_cache_with_confirmation_cancel(): """Test update-cache command cancellation.""" cli = CliRunner() result = cli.invoke(pysigma_group, ["update-cache"], input="n\n") assert result.exit_code == 0 assert "cancelled" in result.output.lower() class FakeCache: def __init__(self, directory): self.directory = str(directory) self._keys = [] self._size = 0 def iterkeys(self): return iter(self._keys) def volume(self): return self._size def seed(self, keys, size): self._keys = list(keys) self._size = size class FakeDataset: def __init__(self, directory, trigger_attr): self.cache = FakeCache(directory) self.trigger_attr = trigger_attr self.urls = [] self.clear_count = 0 def _get_cache(self): return self.cache def clear_cache(self): self.clear_count += 1 self.cache.seed([], 0) def set_url(self, url): self.urls.append(url) def __getattr__(self, name): if name == self.trigger_attr: self.cache.seed(["index"], 42) return {"loaded": True} raise AttributeError(name) def install_fake_sigma_data(monkeypatch, tmp_path): attack_dataset = FakeDataset(tmp_path / "attack-cache", "mitre_attack_techniques_tactics_mapping") d3fend_dataset = FakeDataset(tmp_path / "d3fend-cache", "mitre_d3fend_techniques") fake_sigma_data = types.ModuleType("sigma.data") fake_sigma_data.mitre_attack = attack_dataset fake_sigma_data.mitre_d3fend = d3fend_dataset monkeypatch.setitem(sys.modules, "sigma.data", fake_sigma_data) return attack_dataset, d3fend_dataset def test_update_cache_with_url_overrides(monkeypatch, tmp_path): cli = CliRunner() attack_dataset, d3fend_dataset = install_fake_sigma_data(monkeypatch, tmp_path) attack_path = str(tmp_path / "attack.json") d3fend_path = str(tmp_path / "d3fend.json") result = cli.invoke( pysigma_group, [ "update-cache", "-y", "--url", f"mitre_attack:{attack_path}", "--url", f"mitre_d3fend:{d3fend_path}", ], ) assert result.exit_code == 0 assert attack_dataset.urls == [attack_path] assert d3fend_dataset.urls == [d3fend_path] assert attack_dataset.clear_count == 1 assert d3fend_dataset.clear_count == 1 assert "Cache updated successfully" in result.output def test_update_cache_rejects_invalid_url_format(monkeypatch, tmp_path): cli = CliRunner() install_fake_sigma_data(monkeypatch, tmp_path) result = cli.invoke( pysigma_group, ["update-cache", "-y", "--url", "mitre_attack"], ) assert result.exit_code != 0 assert "dataset:url" in result.output def test_update_cache_rejects_unknown_dataset(monkeypatch, tmp_path): cli = CliRunner() install_fake_sigma_data(monkeypatch, tmp_path) result = cli.invoke( pysigma_group, ["update-cache", "-y", "--url", "unknown:/tmp/dataset.json"], ) assert result.exit_code != 0 assert "unknown dataset 'unknown'" in result.outputSigmaHQ-sigma-cli-f40f47a/tests/test_template_vars.py000066400000000000000000000076331517101166100227140ustar00rootroot00000000000000"""Tests for template variable parameters in convert and analyze commands.""" import pathlib from click.testing import CliRunner from sigma.cli.convert import convert from sigma.cli.analyze import analyze_group import tempfile def test_convert_enable_template_vars_flag(): """Test that --enable-template-vars flag is accepted by convert command.""" cli = CliRunner() result = cli.invoke( convert, [ "-t", "text_query_test", "-p", "another_test", "--disable-pipeline-check", "--enable-template-vars", "tests/files/valid", ], ) # Command should succeed (exit code 0) or fail with a validation error, # not with an unrecognized option error assert "--enable-template-vars" not in result.output assert "Error: no such option" not in result.output.lower() def test_convert_template_vars_path_option(): """Test that --template-vars-path option is accepted by convert command.""" cli = CliRunner() with tempfile.TemporaryDirectory() as tmpdir: result = cli.invoke( convert, [ "-t", "text_query_test", "-p", "another_test", "--disable-pipeline-check", "--template-vars-path", tmpdir, "tests/files/valid", ], ) # Command should succeed or fail with validation error, not option error assert "--template-vars-path" not in result.output assert "Error: no such option" not in result.output.lower() def test_convert_multiple_template_vars_paths(): """Test that multiple --template-vars-path options can be specified.""" cli = CliRunner() with tempfile.TemporaryDirectory() as tmpdir1: with tempfile.TemporaryDirectory() as tmpdir2: result = cli.invoke( convert, [ "-t", "text_query_test", "-p", "another_test", "--disable-pipeline-check", "--template-vars-path", tmpdir1, "--template-vars-path", tmpdir2, "tests/files/valid", ], ) # Command should accept multiple paths without error assert "--template-vars-path" not in result.output assert "Error: no such option" not in result.output.lower() def test_analyze_fields_enable_template_vars_flag(): """Test that --enable-template-vars flag is accepted by analyze fields command.""" cli = CliRunner() result = cli.invoke( analyze_group, [ "fields", "-t", "text_query_test", "-p", "another_test", "--disable-pipeline-check", "--enable-template-vars", "tests/files/valid", ], ) # Command should work without unrecognized option error assert "--enable-template-vars" not in result.output assert "Error: no such option" not in result.output.lower() def test_analyze_fields_template_vars_path_option(): """Test that --template-vars-path option is accepted by analyze fields command.""" cli = CliRunner() with tempfile.TemporaryDirectory() as tmpdir: result = cli.invoke( analyze_group, [ "fields", "-t", "text_query_test", "-p", "another_test", "--disable-pipeline-check", "--template-vars-path", tmpdir, "tests/files/valid", ], ) # Command should accept the path without error assert "--template-vars-path" not in result.output assert "Error: no such option" not in result.output.lower()