pax_global_header00006660000000000000000000000064144740345420014521gustar00rootroot0000000000000052 comment=434ae83d8648007debb2d3b9827d9aa195d1d5b7 sigma-cli-0.7.7/000077500000000000000000000000001447403454200134015ustar00rootroot00000000000000sigma-cli-0.7.7/.github/000077500000000000000000000000001447403454200147415ustar00rootroot00000000000000sigma-cli-0.7.7/.github/FUNDING.yml000066400000000000000000000013441447403454200165600ustar00rootroot00000000000000# These are supported funding model platforms github: [thomaspatzke] patreon: # Replace with a single Patreon username open_collective: # Replace with a single Open Collective username ko_fi: # Replace with a single Ko-fi username tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry liberapay: # Replace with a single Liberapay username issuehunt: # Replace with a single IssueHunt username otechie: # Replace with a single Otechie username lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'] sigma-cli-0.7.7/.github/workflows/000077500000000000000000000000001447403454200167765ustar00rootroot00000000000000sigma-cli-0.7.7/.github/workflows/release.yml000066400000000000000000000022051447403454200211400ustar00rootroot00000000000000name: Release to PyPI on: release: types: [published] push: tags: - v*.*.* jobs: build-and-publish: runs-on: ubuntu-20.04 steps: - uses: actions/checkout@v2 - name: Install Poetry run: pipx install poetry - name: Set up Python uses: actions/setup-python@v2 with: python-version: '3.11' - name: Verify versioning run: | [ "$(poetry version -s)" == "${GITHUB_REF#refs/tags/v}" ] - name: Install dependencies run: poetry install - name: Run tests run: poetry run pytest - name: Build packages run: poetry build - name: Configure Poetry run: | poetry config repositories.testpypi https://test.pypi.org/legacy/ poetry config pypi-token.testpypi ${{ secrets.TEST_PYPI_API_TOKEN }} poetry config pypi-token.pypi "${{ secrets.PYPI_API_TOKEN }}" - name: Publish to test PyPI if: ${{ github.event_name == 'push' }} run: poetry publish -r testpypi - name: Publish to PyPI if: ${{ github.event_name == 'release' }} run: poetry publishsigma-cli-0.7.7/.github/workflows/test.yml000066400000000000000000000024471447403454200205070ustar00rootroot00000000000000name: Test on: push: branches: [ "*" ] pull_request: branches: [ "*" ] workflow_dispatch: jobs: test: strategy: matrix: os: [ 'ubuntu-20.04', 'windows-2019', 'macos-12' ] python-version: [ '3.8', '3.9', '3.10', '3.11' ] runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@v2 - name: Install Poetry run: pipx install poetry - name: Set up Python uses: actions/setup-python@v2 with: python-version: ${{ matrix.python-version }} - name: Install dependencies run: poetry install - name: Run tests run: poetry run pytest --cov=sigma --cov-report term --cov-report xml:cov.xml -vv - name: Store coverage for badge if: ${{ runner.os == 'Linux' }} run: poetry run python print-coverage.py >> $GITHUB_ENV - name: Create coverage badge if: ${{ github.repository == 'SigmaHQ/sigma-cli' && github.event_name == 'push' && runner.os == 'Linux' }} uses: schneegans/dynamic-badges-action@v1.1.0 with: auth: ${{ secrets.GIST_SECRET }} gistID: 0c868df261d4a5d5a1dafe71b1557d69 filename: SigmaHQ-sigma-cli.json label: Coverage message: ${{ env.COVERAGE }} color: ${{ env.COVERAGE_COLOR }} sigma-cli-0.7.7/.gitignore000066400000000000000000000001031447403454200153630ustar00rootroot00000000000000.coverage* .vscode/ **/__pycache__ cov.xml dist/ docs/_build sigma-cli-0.7.7/README.md000066400000000000000000000072771447403454200146750ustar00rootroot00000000000000# Sigma Command Line Interface ![Tests](https://github.com/SigmaHQ/sigma-cli/actions/workflows/test.yml/badge.svg) ![Coverage Badge](https://img.shields.io/endpoint?url=https://gist.githubusercontent.com/thomaspatzke/0c868df261d4a5d5a1dafe71b1557d69/raw/SigmaHQ-sigma-cli.json) ![Status](https://img.shields.io/badge/Status-pre--release-orange) This is the Sigma command line interface using the [pySigma](https://github.com/SigmaHQ/pySigma) library to manage, list and convert Sigma rules into query languages. ## Getting Started ### Installation The easiest way to install the Sigma CLI is via *pipx* or *pip*. For this purpose run one of the following: ``` python -m pipx install sigma-cli python -m pip install sigma-cli ``` on macOS use ``` python3 -m pip install sigma-cli ``` Another way is to run this from source in a virtual environment managed by [Poetry](https://python-poetry.org/docs/basic-usage/): ``` git clone https://github.com/SigmaHQ/sigma-cli.git cd sigma-cli poetry install poetry shell ``` ### Usage The CLI is available as *sigma* command. A typical invocation is: ``` sigma convert -t -p -p [...] ``` E.g. to convert process creation Sigma rules from a directory into Splunk queries for Sysmon logs run: ``` sigma convert -t splunk -p sysmon sigma/rules/windows/process_creation ``` Required backends must be installed using the following command prior to conducting conversions. To list all available plugins run the following command: ``` sigma plugin list ``` Install a plugin of your choice with: ``` sigma plugin install ``` E.g. to install the splunk backend run: ``` sigma plugin install splunk ``` Available conversion backends and processing pipelines can be listed with `sigma list`. Use `-O` or `--backend-option` for passing options to the backend as key=value pairs (`-O testparam=123`) . This backend option parameter can be used multiple times (`-O first=123 -O second=456`). Backends can support different output formats, e.g. plain queries and a file that can be imported into the target system. These formats can be listed with `sigma list formats ` and specified for conversion with the `-f` option. In addition, an output file can be specified with `-o`. Example for output formats and files: ``` sigma convert -t splunk -f savedsearches -p sysmon -o savedsearches.conf sigma/rules/windows/process_creation ``` Outputs a Splunk savedsearches.conf containing the converted searches. ### Integration of Backends and Pipelines Backends and pipelines can be integrated by adding the corresponding packages as dependency with: ``` poetry add ``` A backend has to be added to the `backends` dict in `sigma/cli/backends.py` by creation of a `Backend` named tuple with the following parameters: * The backend class. * A display name shown to the user in the targets list (`sigma list targets`). * A dict that maps output format names (used in `-f` parameter) to descriptions of the formats that are shown in the format list (`sigma list formats `). The formats must be supported by the backend! The dict key is the name used in the `-t` parameter. A processing pipeline is defined in the `pipelines` variable dict in `sigma/cli/pipelines.py`. The variable contains a `ProcessingPipelineResolver` that is instantiated with a dict that maps identifiers that can be used in the `-p` parameter to functions that return `ProcessingPipeline` objects. The descriptive text shown in the pipeline list (`sigma list pipelines`) is provided from the `name` attribute of the `ProcessingPipeline` object. ## Maintainers The project is currently maintained by: - Thomas Patzke sigma-cli-0.7.7/poetry.lock000066400000000000000000001327221447403454200156040ustar00rootroot00000000000000# This file is automatically @generated by Poetry 1.4.2 and should not be changed by hand. [[package]] name = "atomicwrites" version = "1.4.1" description = "Atomic file writes." category = "dev" optional = false python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*" files = [ {file = "atomicwrites-1.4.1.tar.gz", hash = "sha256:81b2c9071a49367a7f770170e5eec8cb66567cfbbc8c73d20ce5ca4a8d71cf11"}, ] [[package]] name = "attrs" version = "23.1.0" description = "Classes Without Boilerplate" category = "dev" optional = false python-versions = ">=3.7" files = [ {file = "attrs-23.1.0-py3-none-any.whl", hash = "sha256:1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04"}, {file = "attrs-23.1.0.tar.gz", hash = "sha256:6279836d581513a26f1bf235f9acd333bc9115683f14f7e8fae46c98fc50e015"}, ] [package.extras] cov = ["attrs[tests]", "coverage[toml] (>=5.3)"] dev = ["attrs[docs,tests]", "pre-commit"] docs = ["furo", "myst-parser", "sphinx", "sphinx-notfound-page", "sphinxcontrib-towncrier", "towncrier", "zope-interface"] tests = ["attrs[tests-no-zope]", "zope-interface"] tests-no-zope = ["cloudpickle", "hypothesis", "mypy (>=1.1.1)", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist[psutil]"] [[package]] name = "certifi" version = "2023.7.22" description = "Python package for providing Mozilla's CA Bundle." category = "main" optional = false python-versions = ">=3.6" files = [ {file = "certifi-2023.7.22-py3-none-any.whl", hash = "sha256:92d6037539857d8206b8f6ae472e8b77db8058fec5937a1ef3f54304089edbb9"}, {file = "certifi-2023.7.22.tar.gz", hash = "sha256:539cc1d13202e33ca466e88b2807e29f4c13049d6d87031a3c110744495cb082"}, ] [[package]] name = "charset-normalizer" version = "3.2.0" description = "The Real First Universal Charset Detector. Open, modern and actively maintained alternative to Chardet." category = "main" optional = false python-versions = ">=3.7.0" files = [ {file = "charset-normalizer-3.2.0.tar.gz", hash = "sha256:3bb3d25a8e6c0aedd251753a79ae98a093c7e7b471faa3aa9a93a81431987ace"}, {file = "charset_normalizer-3.2.0-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:0b87549028f680ca955556e3bd57013ab47474c3124dc069faa0b6545b6c9710"}, {file = "charset_normalizer-3.2.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:7c70087bfee18a42b4040bb9ec1ca15a08242cf5867c58726530bdf3945672ed"}, {file = "charset_normalizer-3.2.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:a103b3a7069b62f5d4890ae1b8f0597618f628b286b03d4bc9195230b154bfa9"}, {file = "charset_normalizer-3.2.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:94aea8eff76ee6d1cdacb07dd2123a68283cb5569e0250feab1240058f53b623"}, {file = "charset_normalizer-3.2.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:db901e2ac34c931d73054d9797383d0f8009991e723dab15109740a63e7f902a"}, {file = "charset_normalizer-3.2.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:b0dac0ff919ba34d4df1b6131f59ce95b08b9065233446be7e459f95554c0dc8"}, {file = "charset_normalizer-3.2.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:193cbc708ea3aca45e7221ae58f0fd63f933753a9bfb498a3b474878f12caaad"}, {file = "charset_normalizer-3.2.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:09393e1b2a9461950b1c9a45d5fd251dc7c6f228acab64da1c9c0165d9c7765c"}, {file = "charset_normalizer-3.2.0-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:baacc6aee0b2ef6f3d308e197b5d7a81c0e70b06beae1f1fcacffdbd124fe0e3"}, {file = "charset_normalizer-3.2.0-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:bf420121d4c8dce6b889f0e8e4ec0ca34b7f40186203f06a946fa0276ba54029"}, {file = "charset_normalizer-3.2.0-cp310-cp310-musllinux_1_1_ppc64le.whl", hash = "sha256:c04a46716adde8d927adb9457bbe39cf473e1e2c2f5d0a16ceb837e5d841ad4f"}, {file = "charset_normalizer-3.2.0-cp310-cp310-musllinux_1_1_s390x.whl", hash = "sha256:aaf63899c94de41fe3cf934601b0f7ccb6b428c6e4eeb80da72c58eab077b19a"}, {file = "charset_normalizer-3.2.0-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:d62e51710986674142526ab9f78663ca2b0726066ae26b78b22e0f5e571238dd"}, {file = "charset_normalizer-3.2.0-cp310-cp310-win32.whl", hash = "sha256:04e57ab9fbf9607b77f7d057974694b4f6b142da9ed4a199859d9d4d5c63fe96"}, {file = "charset_normalizer-3.2.0-cp310-cp310-win_amd64.whl", hash = "sha256:48021783bdf96e3d6de03a6e39a1171ed5bd7e8bb93fc84cc649d11490f87cea"}, {file = "charset_normalizer-3.2.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:4957669ef390f0e6719db3613ab3a7631e68424604a7b448f079bee145da6e09"}, {file = "charset_normalizer-3.2.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:46fb8c61d794b78ec7134a715a3e564aafc8f6b5e338417cb19fe9f57a5a9bf2"}, {file = "charset_normalizer-3.2.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:f779d3ad205f108d14e99bb3859aa7dd8e9c68874617c72354d7ecaec2a054ac"}, {file = "charset_normalizer-3.2.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f25c229a6ba38a35ae6e25ca1264621cc25d4d38dca2942a7fce0b67a4efe918"}, {file = "charset_normalizer-3.2.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:2efb1bd13885392adfda4614c33d3b68dee4921fd0ac1d3988f8cbb7d589e72a"}, {file = "charset_normalizer-3.2.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:1f30b48dd7fa1474554b0b0f3fdfdd4c13b5c737a3c6284d3cdc424ec0ffff3a"}, {file = "charset_normalizer-3.2.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:246de67b99b6851627d945db38147d1b209a899311b1305dd84916f2b88526c6"}, {file = "charset_normalizer-3.2.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:9bd9b3b31adcb054116447ea22caa61a285d92e94d710aa5ec97992ff5eb7cf3"}, {file = "charset_normalizer-3.2.0-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:8c2f5e83493748286002f9369f3e6607c565a6a90425a3a1fef5ae32a36d749d"}, {file = "charset_normalizer-3.2.0-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:3170c9399da12c9dc66366e9d14da8bf7147e1e9d9ea566067bbce7bb74bd9c2"}, {file = "charset_normalizer-3.2.0-cp311-cp311-musllinux_1_1_ppc64le.whl", hash = "sha256:7a4826ad2bd6b07ca615c74ab91f32f6c96d08f6fcc3902ceeedaec8cdc3bcd6"}, {file = "charset_normalizer-3.2.0-cp311-cp311-musllinux_1_1_s390x.whl", hash = "sha256:3b1613dd5aee995ec6d4c69f00378bbd07614702a315a2cf6c1d21461fe17c23"}, {file = "charset_normalizer-3.2.0-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:9e608aafdb55eb9f255034709e20d5a83b6d60c054df0802fa9c9883d0a937aa"}, {file = "charset_normalizer-3.2.0-cp311-cp311-win32.whl", hash = "sha256:f2a1d0fd4242bd8643ce6f98927cf9c04540af6efa92323e9d3124f57727bfc1"}, {file = "charset_normalizer-3.2.0-cp311-cp311-win_amd64.whl", hash = "sha256:681eb3d7e02e3c3655d1b16059fbfb605ac464c834a0c629048a30fad2b27489"}, {file = "charset_normalizer-3.2.0-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:c57921cda3a80d0f2b8aec7e25c8aa14479ea92b5b51b6876d975d925a2ea346"}, {file = "charset_normalizer-3.2.0-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:41b25eaa7d15909cf3ac4c96088c1f266a9a93ec44f87f1d13d4a0e86c81b982"}, {file = "charset_normalizer-3.2.0-cp37-cp37m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f058f6963fd82eb143c692cecdc89e075fa0828db2e5b291070485390b2f1c9c"}, {file = "charset_normalizer-3.2.0-cp37-cp37m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:a7647ebdfb9682b7bb97e2a5e7cb6ae735b1c25008a70b906aecca294ee96cf4"}, {file = "charset_normalizer-3.2.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:eef9df1eefada2c09a5e7a40991b9fc6ac6ef20b1372abd48d2794a316dc0449"}, {file = "charset_normalizer-3.2.0-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e03b8895a6990c9ab2cdcd0f2fe44088ca1c65ae592b8f795c3294af00a461c3"}, {file = "charset_normalizer-3.2.0-cp37-cp37m-musllinux_1_1_aarch64.whl", hash = "sha256:ee4006268ed33370957f55bf2e6f4d263eaf4dc3cfc473d1d90baff6ed36ce4a"}, {file = "charset_normalizer-3.2.0-cp37-cp37m-musllinux_1_1_i686.whl", hash = "sha256:c4983bf937209c57240cff65906b18bb35e64ae872da6a0db937d7b4af845dd7"}, {file = "charset_normalizer-3.2.0-cp37-cp37m-musllinux_1_1_ppc64le.whl", hash = "sha256:3bb7fda7260735efe66d5107fb7e6af6a7c04c7fce9b2514e04b7a74b06bf5dd"}, {file = "charset_normalizer-3.2.0-cp37-cp37m-musllinux_1_1_s390x.whl", hash = "sha256:72814c01533f51d68702802d74f77ea026b5ec52793c791e2da806a3844a46c3"}, {file = "charset_normalizer-3.2.0-cp37-cp37m-musllinux_1_1_x86_64.whl", hash = "sha256:70c610f6cbe4b9fce272c407dd9d07e33e6bf7b4aa1b7ffb6f6ded8e634e3592"}, {file = "charset_normalizer-3.2.0-cp37-cp37m-win32.whl", hash = "sha256:a401b4598e5d3f4a9a811f3daf42ee2291790c7f9d74b18d75d6e21dda98a1a1"}, {file = "charset_normalizer-3.2.0-cp37-cp37m-win_amd64.whl", hash = "sha256:c0b21078a4b56965e2b12f247467b234734491897e99c1d51cee628da9786959"}, {file = "charset_normalizer-3.2.0-cp38-cp38-macosx_10_9_universal2.whl", hash = "sha256:95eb302ff792e12aba9a8b8f8474ab229a83c103d74a750ec0bd1c1eea32e669"}, {file = "charset_normalizer-3.2.0-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:1a100c6d595a7f316f1b6f01d20815d916e75ff98c27a01ae817439ea7726329"}, {file = "charset_normalizer-3.2.0-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:6339d047dab2780cc6220f46306628e04d9750f02f983ddb37439ca47ced7149"}, {file = "charset_normalizer-3.2.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e4b749b9cc6ee664a3300bb3a273c1ca8068c46be705b6c31cf5d276f8628a94"}, {file = "charset_normalizer-3.2.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:a38856a971c602f98472050165cea2cdc97709240373041b69030be15047691f"}, {file = "charset_normalizer-3.2.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f87f746ee241d30d6ed93969de31e5ffd09a2961a051e60ae6bddde9ec3583aa"}, {file = "charset_normalizer-3.2.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:89f1b185a01fe560bc8ae5f619e924407efca2191b56ce749ec84982fc59a32a"}, {file = "charset_normalizer-3.2.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e1c8a2f4c69e08e89632defbfabec2feb8a8d99edc9f89ce33c4b9e36ab63037"}, {file = "charset_normalizer-3.2.0-cp38-cp38-musllinux_1_1_aarch64.whl", hash = "sha256:2f4ac36d8e2b4cc1aa71df3dd84ff8efbe3bfb97ac41242fbcfc053c67434f46"}, {file = "charset_normalizer-3.2.0-cp38-cp38-musllinux_1_1_i686.whl", hash = "sha256:a386ebe437176aab38c041de1260cd3ea459c6ce5263594399880bbc398225b2"}, {file = "charset_normalizer-3.2.0-cp38-cp38-musllinux_1_1_ppc64le.whl", hash = "sha256:ccd16eb18a849fd8dcb23e23380e2f0a354e8daa0c984b8a732d9cfaba3a776d"}, {file = "charset_normalizer-3.2.0-cp38-cp38-musllinux_1_1_s390x.whl", hash = "sha256:e6a5bf2cba5ae1bb80b154ed68a3cfa2fa00fde979a7f50d6598d3e17d9ac20c"}, {file = "charset_normalizer-3.2.0-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:45de3f87179c1823e6d9e32156fb14c1927fcc9aba21433f088fdfb555b77c10"}, {file = "charset_normalizer-3.2.0-cp38-cp38-win32.whl", hash = "sha256:1000fba1057b92a65daec275aec30586c3de2401ccdcd41f8a5c1e2c87078706"}, {file = "charset_normalizer-3.2.0-cp38-cp38-win_amd64.whl", hash = "sha256:8b2c760cfc7042b27ebdb4a43a4453bd829a5742503599144d54a032c5dc7e9e"}, {file = "charset_normalizer-3.2.0-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:855eafa5d5a2034b4621c74925d89c5efef61418570e5ef9b37717d9c796419c"}, {file = "charset_normalizer-3.2.0-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:203f0c8871d5a7987be20c72442488a0b8cfd0f43b7973771640fc593f56321f"}, {file = "charset_normalizer-3.2.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:e857a2232ba53ae940d3456f7533ce6ca98b81917d47adc3c7fd55dad8fab858"}, {file = "charset_normalizer-3.2.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5e86d77b090dbddbe78867a0275cb4df08ea195e660f1f7f13435a4649e954e5"}, {file = "charset_normalizer-3.2.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:c4fb39a81950ec280984b3a44f5bd12819953dc5fa3a7e6fa7a80db5ee853952"}, {file = "charset_normalizer-3.2.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:2dee8e57f052ef5353cf608e0b4c871aee320dd1b87d351c28764fc0ca55f9f4"}, {file = "charset_normalizer-3.2.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8700f06d0ce6f128de3ccdbc1acaea1ee264d2caa9ca05daaf492fde7c2a7200"}, {file = "charset_normalizer-3.2.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1920d4ff15ce893210c1f0c0e9d19bfbecb7983c76b33f046c13a8ffbd570252"}, {file = "charset_normalizer-3.2.0-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:c1c76a1743432b4b60ab3358c937a3fe1341c828ae6194108a94c69028247f22"}, {file = "charset_normalizer-3.2.0-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:f7560358a6811e52e9c4d142d497f1a6e10103d3a6881f18d04dbce3729c0e2c"}, {file = "charset_normalizer-3.2.0-cp39-cp39-musllinux_1_1_ppc64le.whl", hash = "sha256:c8063cf17b19661471ecbdb3df1c84f24ad2e389e326ccaf89e3fb2484d8dd7e"}, {file = "charset_normalizer-3.2.0-cp39-cp39-musllinux_1_1_s390x.whl", hash = "sha256:cd6dbe0238f7743d0efe563ab46294f54f9bc8f4b9bcf57c3c666cc5bc9d1299"}, {file = "charset_normalizer-3.2.0-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:1249cbbf3d3b04902ff081ffbb33ce3377fa6e4c7356f759f3cd076cc138d020"}, {file = "charset_normalizer-3.2.0-cp39-cp39-win32.whl", hash = "sha256:6c409c0deba34f147f77efaa67b8e4bb83d2f11c8806405f76397ae5b8c0d1c9"}, {file = "charset_normalizer-3.2.0-cp39-cp39-win_amd64.whl", hash = "sha256:7095f6fbfaa55defb6b733cfeb14efaae7a29f0b59d8cf213be4e7ca0b857b80"}, {file = "charset_normalizer-3.2.0-py3-none-any.whl", hash = "sha256:8e098148dd37b4ce3baca71fb394c81dc5d9c7728c95df695d2dca218edf40e6"}, ] [[package]] name = "click" version = "8.1.7" description = "Composable command line interface toolkit" category = "main" optional = false python-versions = ">=3.7" files = [ {file = "click-8.1.7-py3-none-any.whl", hash = "sha256:ae74fb96c20a0277a1d615f1e4d73c8414f5a98db8b799a7931d1582f3390c28"}, {file = "click-8.1.7.tar.gz", hash = "sha256:ca9853ad459e787e2192211578cc907e7594e294c7ccc834310722b41b9ca6de"}, ] [package.dependencies] colorama = {version = "*", markers = "platform_system == \"Windows\""} [[package]] name = "colorama" version = "0.4.6" description = "Cross-platform colored terminal text." category = "main" optional = false python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7" files = [ {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"}, {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"}, ] [[package]] name = "coverage" version = "7.3.0" description = "Code coverage measurement for Python" category = "dev" optional = false python-versions = ">=3.8" files = [ {file = "coverage-7.3.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:db76a1bcb51f02b2007adacbed4c88b6dee75342c37b05d1822815eed19edee5"}, {file = "coverage-7.3.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:c02cfa6c36144ab334d556989406837336c1d05215a9bdf44c0bc1d1ac1cb637"}, {file = "coverage-7.3.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:477c9430ad5d1b80b07f3c12f7120eef40bfbf849e9e7859e53b9c93b922d2af"}, {file = "coverage-7.3.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ce2ee86ca75f9f96072295c5ebb4ef2a43cecf2870b0ca5e7a1cbdd929cf67e1"}, {file = "coverage-7.3.0-cp310-cp310-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:68d8a0426b49c053013e631c0cdc09b952d857efa8f68121746b339912d27a12"}, {file = "coverage-7.3.0-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:b3eb0c93e2ea6445b2173da48cb548364f8f65bf68f3d090404080d338e3a689"}, {file = "coverage-7.3.0-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:90b6e2f0f66750c5a1178ffa9370dec6c508a8ca5265c42fbad3ccac210a7977"}, {file = "coverage-7.3.0-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:96d7d761aea65b291a98c84e1250cd57b5b51726821a6f2f8df65db89363be51"}, {file = "coverage-7.3.0-cp310-cp310-win32.whl", hash = "sha256:63c5b8ecbc3b3d5eb3a9d873dec60afc0cd5ff9d9f1c75981d8c31cfe4df8527"}, {file = "coverage-7.3.0-cp310-cp310-win_amd64.whl", hash = "sha256:97c44f4ee13bce914272589b6b41165bbb650e48fdb7bd5493a38bde8de730a1"}, {file = "coverage-7.3.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:74c160285f2dfe0acf0f72d425f3e970b21b6de04157fc65adc9fd07ee44177f"}, {file = "coverage-7.3.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:b543302a3707245d454fc49b8ecd2c2d5982b50eb63f3535244fd79a4be0c99d"}, {file = "coverage-7.3.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ad0f87826c4ebd3ef484502e79b39614e9c03a5d1510cfb623f4a4a051edc6fd"}, {file = "coverage-7.3.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:13c6cbbd5f31211d8fdb477f0f7b03438591bdd077054076eec362cf2207b4a7"}, {file = "coverage-7.3.0-cp311-cp311-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fac440c43e9b479d1241fe9d768645e7ccec3fb65dc3a5f6e90675e75c3f3e3a"}, {file = "coverage-7.3.0-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:3c9834d5e3df9d2aba0275c9f67989c590e05732439b3318fa37a725dff51e74"}, {file = "coverage-7.3.0-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:4c8e31cf29b60859876474034a83f59a14381af50cbe8a9dbaadbf70adc4b214"}, {file = "coverage-7.3.0-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:7a9baf8e230f9621f8e1d00c580394a0aa328fdac0df2b3f8384387c44083c0f"}, {file = "coverage-7.3.0-cp311-cp311-win32.whl", hash = "sha256:ccc51713b5581e12f93ccb9c5e39e8b5d4b16776d584c0f5e9e4e63381356482"}, {file = "coverage-7.3.0-cp311-cp311-win_amd64.whl", hash = "sha256:887665f00ea4e488501ba755a0e3c2cfd6278e846ada3185f42d391ef95e7e70"}, {file = "coverage-7.3.0-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:d000a739f9feed900381605a12a61f7aaced6beae832719ae0d15058a1e81c1b"}, {file = "coverage-7.3.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:59777652e245bb1e300e620ce2bef0d341945842e4eb888c23a7f1d9e143c446"}, {file = "coverage-7.3.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c9737bc49a9255d78da085fa04f628a310c2332b187cd49b958b0e494c125071"}, {file = "coverage-7.3.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:5247bab12f84a1d608213b96b8af0cbb30d090d705b6663ad794c2f2a5e5b9fe"}, {file = "coverage-7.3.0-cp312-cp312-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e2ac9a1de294773b9fa77447ab7e529cf4fe3910f6a0832816e5f3d538cfea9a"}, {file = "coverage-7.3.0-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:85b7335c22455ec12444cec0d600533a238d6439d8d709d545158c1208483873"}, {file = "coverage-7.3.0-cp312-cp312-musllinux_1_1_i686.whl", hash = "sha256:36ce5d43a072a036f287029a55b5c6a0e9bd73db58961a273b6dc11a2c6eb9c2"}, {file = "coverage-7.3.0-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:211a4576e984f96d9fce61766ffaed0115d5dab1419e4f63d6992b480c2bd60b"}, {file = "coverage-7.3.0-cp312-cp312-win32.whl", hash = "sha256:56afbf41fa4a7b27f6635bc4289050ac3ab7951b8a821bca46f5b024500e6321"}, {file = "coverage-7.3.0-cp312-cp312-win_amd64.whl", hash = "sha256:7f297e0c1ae55300ff688568b04ff26b01c13dfbf4c9d2b7d0cb688ac60df479"}, {file = "coverage-7.3.0-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:ac0dec90e7de0087d3d95fa0533e1d2d722dcc008bc7b60e1143402a04c117c1"}, {file = "coverage-7.3.0-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:438856d3f8f1e27f8e79b5410ae56650732a0dcfa94e756df88c7e2d24851fcd"}, {file = "coverage-7.3.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1084393c6bda8875c05e04fce5cfe1301a425f758eb012f010eab586f1f3905e"}, {file = "coverage-7.3.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:49ab200acf891e3dde19e5aa4b0f35d12d8b4bd805dc0be8792270c71bd56c54"}, {file = "coverage-7.3.0-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a67e6bbe756ed458646e1ef2b0778591ed4d1fcd4b146fc3ba2feb1a7afd4254"}, {file = "coverage-7.3.0-cp38-cp38-musllinux_1_1_aarch64.whl", hash = "sha256:8f39c49faf5344af36042b293ce05c0d9004270d811c7080610b3e713251c9b0"}, {file = "coverage-7.3.0-cp38-cp38-musllinux_1_1_i686.whl", hash = "sha256:7df91fb24c2edaabec4e0eee512ff3bc6ec20eb8dccac2e77001c1fe516c0c84"}, {file = "coverage-7.3.0-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:34f9f0763d5fa3035a315b69b428fe9c34d4fc2f615262d6be3d3bf3882fb985"}, {file = "coverage-7.3.0-cp38-cp38-win32.whl", hash = "sha256:bac329371d4c0d456e8d5f38a9b0816b446581b5f278474e416ea0c68c47dcd9"}, {file = "coverage-7.3.0-cp38-cp38-win_amd64.whl", hash = "sha256:b859128a093f135b556b4765658d5d2e758e1fae3e7cc2f8c10f26fe7005e543"}, {file = "coverage-7.3.0-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:fc0ed8d310afe013db1eedd37176d0839dc66c96bcfcce8f6607a73ffea2d6ba"}, {file = "coverage-7.3.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:e61260ec93f99f2c2d93d264b564ba912bec502f679793c56f678ba5251f0393"}, {file = "coverage-7.3.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:97af9554a799bd7c58c0179cc8dbf14aa7ab50e1fd5fa73f90b9b7215874ba28"}, {file = "coverage-7.3.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:3558e5b574d62f9c46b76120a5c7c16c4612dc2644c3d48a9f4064a705eaee95"}, {file = "coverage-7.3.0-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:37d5576d35fcb765fca05654f66aa71e2808d4237d026e64ac8b397ffa66a56a"}, {file = "coverage-7.3.0-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:07ea61bcb179f8f05ffd804d2732b09d23a1238642bf7e51dad62082b5019b34"}, {file = "coverage-7.3.0-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:80501d1b2270d7e8daf1b64b895745c3e234289e00d5f0e30923e706f110334e"}, {file = "coverage-7.3.0-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:4eddd3153d02204f22aef0825409091a91bf2a20bce06fe0f638f5c19a85de54"}, {file = "coverage-7.3.0-cp39-cp39-win32.whl", hash = "sha256:2d22172f938455c156e9af2612650f26cceea47dc86ca048fa4e0b2d21646ad3"}, {file = "coverage-7.3.0-cp39-cp39-win_amd64.whl", hash = "sha256:60f64e2007c9144375dd0f480a54d6070f00bb1a28f65c408370544091c9bc9e"}, {file = "coverage-7.3.0-pp38.pp39.pp310-none-any.whl", hash = "sha256:5492a6ce3bdb15c6ad66cb68a0244854d9917478877a25671d70378bdc8562d0"}, {file = "coverage-7.3.0.tar.gz", hash = "sha256:49dbb19cdcafc130f597d9e04a29d0a032ceedf729e41b181f51cd170e6ee865"}, ] [package.extras] toml = ["tomli"] [[package]] name = "idna" version = "3.4" description = "Internationalized Domain Names in Applications (IDNA)" category = "main" optional = false python-versions = ">=3.5" files = [ {file = "idna-3.4-py3-none-any.whl", hash = "sha256:90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"}, {file = "idna-3.4.tar.gz", hash = "sha256:814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"}, ] [[package]] name = "iniconfig" version = "2.0.0" description = "brain-dead simple config-ini parsing" category = "dev" optional = false python-versions = ">=3.7" files = [ {file = "iniconfig-2.0.0-py3-none-any.whl", hash = "sha256:b6a85871a79d2e3b22d2d1b94ac2824226a63c6b741c88f7ae975f18b6778374"}, {file = "iniconfig-2.0.0.tar.gz", hash = "sha256:2d91e135bf72d31a410b17c16da610a82cb55f6b0477d1a902134b24a455b8b3"}, ] [[package]] name = "jinja2" version = "3.1.2" description = "A very fast and expressive template engine." category = "main" optional = false python-versions = ">=3.7" files = [ {file = "Jinja2-3.1.2-py3-none-any.whl", hash = "sha256:6088930bfe239f0e6710546ab9c19c9ef35e29792895fed6e6e31a023a182a61"}, {file = "Jinja2-3.1.2.tar.gz", hash = "sha256:31351a702a408a9e7595a8fc6150fc3f43bb6bf7e319770cbc0db9df9437e852"}, ] [package.dependencies] MarkupSafe = ">=2.0" [package.extras] i18n = ["Babel (>=2.7)"] [[package]] name = "markupsafe" version = "2.1.3" description = "Safely add untrusted strings to HTML/XML markup." category = "main" optional = false python-versions = ">=3.7" files = [ {file = "MarkupSafe-2.1.3-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:cd0f502fe016460680cd20aaa5a76d241d6f35a1c3350c474bac1273803893fa"}, {file = "MarkupSafe-2.1.3-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:e09031c87a1e51556fdcb46e5bd4f59dfb743061cf93c4d6831bf894f125eb57"}, {file = "MarkupSafe-2.1.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:68e78619a61ecf91e76aa3e6e8e33fc4894a2bebe93410754bd28fce0a8a4f9f"}, {file = "MarkupSafe-2.1.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:65c1a9bcdadc6c28eecee2c119465aebff8f7a584dd719facdd9e825ec61ab52"}, {file = "MarkupSafe-2.1.3-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:525808b8019e36eb524b8c68acdd63a37e75714eac50e988180b169d64480a00"}, {file = "MarkupSafe-2.1.3-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:962f82a3086483f5e5f64dbad880d31038b698494799b097bc59c2edf392fce6"}, {file = "MarkupSafe-2.1.3-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:aa7bd130efab1c280bed0f45501b7c8795f9fdbeb02e965371bbef3523627779"}, {file = "MarkupSafe-2.1.3-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:c9c804664ebe8f83a211cace637506669e7890fec1b4195b505c214e50dd4eb7"}, {file = "MarkupSafe-2.1.3-cp310-cp310-win32.whl", hash = "sha256:10bbfe99883db80bdbaff2dcf681dfc6533a614f700da1287707e8a5d78a8431"}, {file = "MarkupSafe-2.1.3-cp310-cp310-win_amd64.whl", hash = "sha256:1577735524cdad32f9f694208aa75e422adba74f1baee7551620e43a3141f559"}, {file = "MarkupSafe-2.1.3-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:ad9e82fb8f09ade1c3e1b996a6337afac2b8b9e365f926f5a61aacc71adc5b3c"}, {file = "MarkupSafe-2.1.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:3c0fae6c3be832a0a0473ac912810b2877c8cb9d76ca48de1ed31e1c68386575"}, {file = "MarkupSafe-2.1.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b076b6226fb84157e3f7c971a47ff3a679d837cf338547532ab866c57930dbee"}, {file = "MarkupSafe-2.1.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bfce63a9e7834b12b87c64d6b155fdd9b3b96191b6bd334bf37db7ff1fe457f2"}, {file = "MarkupSafe-2.1.3-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:338ae27d6b8745585f87218a3f23f1512dbf52c26c28e322dbe54bcede54ccb9"}, {file = "MarkupSafe-2.1.3-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:e4dd52d80b8c83fdce44e12478ad2e85c64ea965e75d66dbeafb0a3e77308fcc"}, {file = "MarkupSafe-2.1.3-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:df0be2b576a7abbf737b1575f048c23fb1d769f267ec4358296f31c2479db8f9"}, {file = "MarkupSafe-2.1.3-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:5bbe06f8eeafd38e5d0a4894ffec89378b6c6a625ff57e3028921f8ff59318ac"}, {file = "MarkupSafe-2.1.3-cp311-cp311-win32.whl", hash = "sha256:dd15ff04ffd7e05ffcb7fe79f1b98041b8ea30ae9234aed2a9168b5797c3effb"}, {file = "MarkupSafe-2.1.3-cp311-cp311-win_amd64.whl", hash = "sha256:134da1eca9ec0ae528110ccc9e48041e0828d79f24121a1a146161103c76e686"}, {file = "MarkupSafe-2.1.3-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:8e254ae696c88d98da6555f5ace2279cf7cd5b3f52be2b5cf97feafe883b58d2"}, {file = "MarkupSafe-2.1.3-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cb0932dc158471523c9637e807d9bfb93e06a95cbf010f1a38b98623b929ef2b"}, {file = "MarkupSafe-2.1.3-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9402b03f1a1b4dc4c19845e5c749e3ab82d5078d16a2a4c2cd2df62d57bb0707"}, {file = "MarkupSafe-2.1.3-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ca379055a47383d02a5400cb0d110cef0a776fc644cda797db0c5696cfd7e18e"}, {file = "MarkupSafe-2.1.3-cp37-cp37m-musllinux_1_1_aarch64.whl", hash = "sha256:b7ff0f54cb4ff66dd38bebd335a38e2c22c41a8ee45aa608efc890ac3e3931bc"}, {file = "MarkupSafe-2.1.3-cp37-cp37m-musllinux_1_1_i686.whl", hash = "sha256:c011a4149cfbcf9f03994ec2edffcb8b1dc2d2aede7ca243746df97a5d41ce48"}, {file = "MarkupSafe-2.1.3-cp37-cp37m-musllinux_1_1_x86_64.whl", hash = "sha256:56d9f2ecac662ca1611d183feb03a3fa4406469dafe241673d521dd5ae92a155"}, {file = "MarkupSafe-2.1.3-cp37-cp37m-win32.whl", hash = "sha256:8758846a7e80910096950b67071243da3e5a20ed2546e6392603c096778d48e0"}, {file = "MarkupSafe-2.1.3-cp37-cp37m-win_amd64.whl", hash = "sha256:787003c0ddb00500e49a10f2844fac87aa6ce977b90b0feaaf9de23c22508b24"}, {file = "MarkupSafe-2.1.3-cp38-cp38-macosx_10_9_universal2.whl", hash = "sha256:2ef12179d3a291be237280175b542c07a36e7f60718296278d8593d21ca937d4"}, {file = "MarkupSafe-2.1.3-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:2c1b19b3aaacc6e57b7e25710ff571c24d6c3613a45e905b1fde04d691b98ee0"}, {file = "MarkupSafe-2.1.3-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8afafd99945ead6e075b973fefa56379c5b5c53fd8937dad92c662da5d8fd5ee"}, {file = "MarkupSafe-2.1.3-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8c41976a29d078bb235fea9b2ecd3da465df42a562910f9022f1a03107bd02be"}, {file = "MarkupSafe-2.1.3-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d080e0a5eb2529460b30190fcfcc4199bd7f827663f858a226a81bc27beaa97e"}, {file = "MarkupSafe-2.1.3-cp38-cp38-musllinux_1_1_aarch64.whl", hash = "sha256:69c0f17e9f5a7afdf2cc9fb2d1ce6aabdb3bafb7f38017c0b77862bcec2bbad8"}, {file = "MarkupSafe-2.1.3-cp38-cp38-musllinux_1_1_i686.whl", hash = "sha256:504b320cd4b7eff6f968eddf81127112db685e81f7e36e75f9f84f0df46041c3"}, {file = "MarkupSafe-2.1.3-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:42de32b22b6b804f42c5d98be4f7e5e977ecdd9ee9b660fda1a3edf03b11792d"}, {file = "MarkupSafe-2.1.3-cp38-cp38-win32.whl", hash = "sha256:ceb01949af7121f9fc39f7d27f91be8546f3fb112c608bc4029aef0bab86a2a5"}, {file = "MarkupSafe-2.1.3-cp38-cp38-win_amd64.whl", hash = "sha256:1b40069d487e7edb2676d3fbdb2b0829ffa2cd63a2ec26c4938b2d34391b4ecc"}, {file = "MarkupSafe-2.1.3-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:8023faf4e01efadfa183e863fefde0046de576c6f14659e8782065bcece22198"}, {file = "MarkupSafe-2.1.3-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:6b2b56950d93e41f33b4223ead100ea0fe11f8e6ee5f641eb753ce4b77a7042b"}, {file = "MarkupSafe-2.1.3-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9dcdfd0eaf283af041973bff14a2e143b8bd64e069f4c383416ecd79a81aab58"}, {file = "MarkupSafe-2.1.3-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:05fb21170423db021895e1ea1e1f3ab3adb85d1c2333cbc2310f2a26bc77272e"}, {file = "MarkupSafe-2.1.3-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:282c2cb35b5b673bbcadb33a585408104df04f14b2d9b01d4c345a3b92861c2c"}, {file = "MarkupSafe-2.1.3-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:ab4a0df41e7c16a1392727727e7998a467472d0ad65f3ad5e6e765015df08636"}, {file = "MarkupSafe-2.1.3-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:7ef3cb2ebbf91e330e3bb937efada0edd9003683db6b57bb108c4001f37a02ea"}, {file = "MarkupSafe-2.1.3-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:0a4e4a1aff6c7ac4cd55792abf96c915634c2b97e3cc1c7129578aa68ebd754e"}, {file = "MarkupSafe-2.1.3-cp39-cp39-win32.whl", hash = "sha256:fec21693218efe39aa7f8599346e90c705afa52c5b31ae019b2e57e8f6542bb2"}, {file = "MarkupSafe-2.1.3-cp39-cp39-win_amd64.whl", hash = "sha256:3fd4abcb888d15a94f32b75d8fd18ee162ca0c064f35b11134be77050296d6ba"}, {file = "MarkupSafe-2.1.3.tar.gz", hash = "sha256:af598ed32d6ae86f1b747b82783958b1a4ab8f617b06fe68795c7f026abbdcad"}, ] [[package]] name = "packaging" version = "22.0" description = "Core utilities for Python packages" category = "main" optional = false python-versions = ">=3.7" files = [ {file = "packaging-22.0-py3-none-any.whl", hash = "sha256:957e2148ba0e1a3b282772e791ef1d8083648bc131c8ab0c1feba110ce1146c3"}, {file = "packaging-22.0.tar.gz", hash = "sha256:2198ec20bd4c017b8f9717e00f0c8714076fc2fd93816750ab48e2c41de2cfd3"}, ] [[package]] name = "pluggy" version = "1.3.0" description = "plugin and hook calling mechanisms for python" category = "dev" optional = false python-versions = ">=3.8" files = [ {file = "pluggy-1.3.0-py3-none-any.whl", hash = "sha256:d89c696a773f8bd377d18e5ecda92b7a3793cbe66c87060a6fb58c7b6e1061f7"}, {file = "pluggy-1.3.0.tar.gz", hash = "sha256:cf61ae8f126ac6f7c451172cf30e3e43d3ca77615509771b3a984a0730651e12"}, ] [package.extras] dev = ["pre-commit", "tox"] testing = ["pytest", "pytest-benchmark"] [[package]] name = "prettytable" version = "3.8.0" description = "A simple Python library for easily displaying tabular data in a visually appealing ASCII table format" category = "main" optional = false python-versions = ">=3.8" files = [ {file = "prettytable-3.8.0-py3-none-any.whl", hash = "sha256:03481bca25ae0c28958c8cd6ac5165c159ce89f7ccde04d5c899b24b68bb13b7"}, {file = "prettytable-3.8.0.tar.gz", hash = "sha256:031eae6a9102017e8c7c7906460d150b7ed78b20fd1d8c8be4edaf88556c07ce"}, ] [package.dependencies] wcwidth = "*" [package.extras] tests = ["pytest", "pytest-cov", "pytest-lazy-fixture"] [[package]] name = "py" version = "1.11.0" description = "library with cross-python path, ini-parsing, io, code, log facilities" category = "dev" optional = false python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*" files = [ {file = "py-1.11.0-py2.py3-none-any.whl", hash = "sha256:607c53218732647dff4acdfcd50cb62615cedf612e72d1724fb1a0cc6405b378"}, {file = "py-1.11.0.tar.gz", hash = "sha256:51c75c4126074b472f746a24399ad32f6053d1b34b68d2fa41e558e6f4a98719"}, ] [[package]] name = "pyparsing" version = "3.1.1" description = "pyparsing module - Classes and methods to define and execute parsing grammars" category = "main" optional = false python-versions = ">=3.6.8" files = [ {file = "pyparsing-3.1.1-py3-none-any.whl", hash = "sha256:32c7c0b711493c72ff18a981d24f28aaf9c1fb7ed5e9667c9e84e3db623bdbfb"}, {file = "pyparsing-3.1.1.tar.gz", hash = "sha256:ede28a1a32462f5a9705e07aea48001a08f7cf81a021585011deba701581a0db"}, ] [package.extras] diagrams = ["jinja2", "railroad-diagrams"] [[package]] name = "pysigma" version = "0.10.4" description = "Sigma rule processing and conversion tools" category = "main" optional = false python-versions = ">=3.8,<4.0" files = [ {file = "pysigma-0.10.4-py3-none-any.whl", hash = "sha256:5019d6b3e6ff452501399bbc997f0d1a929083a99ed4082aeb7c59c7e9d86d30"}, {file = "pysigma-0.10.4.tar.gz", hash = "sha256:d27334b001c4dbe7ac240c95dee51339e1bfab4f353362ed0ae8944f399c970f"}, ] [package.dependencies] jinja2 = ">=3.1.2,<4.0.0" packaging = ">=22.0,<23.0" pyparsing = ">=3.0.7,<4.0.0" pyyaml = ">=6.0,<7.0" requests = ">=2.28.1,<3.0.0" [[package]] name = "pytest" version = "6.2.5" description = "pytest: simple powerful testing with Python" category = "dev" optional = false python-versions = ">=3.6" files = [ {file = "pytest-6.2.5-py3-none-any.whl", hash = "sha256:7310f8d27bc79ced999e760ca304d69f6ba6c6649c0b60fb0e04a4a77cacc134"}, {file = "pytest-6.2.5.tar.gz", hash = "sha256:131b36680866a76e6781d13f101efb86cf674ebb9762eb70d3082b6f29889e89"}, ] [package.dependencies] atomicwrites = {version = ">=1.0", markers = "sys_platform == \"win32\""} attrs = ">=19.2.0" colorama = {version = "*", markers = "sys_platform == \"win32\""} iniconfig = "*" packaging = "*" pluggy = ">=0.12,<2.0" py = ">=1.8.2" toml = "*" [package.extras] testing = ["argcomplete", "hypothesis (>=3.56)", "mock", "nose", "requests", "xmlschema"] [[package]] name = "pytest-cov" version = "2.12.1" description = "Pytest plugin for measuring coverage." category = "dev" optional = false python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*" files = [ {file = "pytest-cov-2.12.1.tar.gz", hash = "sha256:261ceeb8c227b726249b376b8526b600f38667ee314f910353fa318caa01f4d7"}, {file = "pytest_cov-2.12.1-py2.py3-none-any.whl", hash = "sha256:261bb9e47e65bd099c89c3edf92972865210c36813f80ede5277dceb77a4a62a"}, ] [package.dependencies] coverage = ">=5.2.1" pytest = ">=4.6" toml = "*" [package.extras] testing = ["fields", "hunter", "process-tests", "pytest-xdist", "six", "virtualenv"] [[package]] name = "pyyaml" version = "6.0.1" description = "YAML parser and emitter for Python" category = "main" optional = false python-versions = ">=3.6" files = [ {file = "PyYAML-6.0.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:d858aa552c999bc8a8d57426ed01e40bef403cd8ccdd0fc5f6f04a00414cac2a"}, {file = "PyYAML-6.0.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:fd66fc5d0da6d9815ba2cebeb4205f95818ff4b79c3ebe268e75d961704af52f"}, {file = "PyYAML-6.0.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:69b023b2b4daa7548bcfbd4aa3da05b3a74b772db9e23b982788168117739938"}, {file = "PyYAML-6.0.1-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:81e0b275a9ecc9c0c0c07b4b90ba548307583c125f54d5b6946cfee6360c733d"}, {file = "PyYAML-6.0.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ba336e390cd8e4d1739f42dfe9bb83a3cc2e80f567d8805e11b46f4a943f5515"}, {file = "PyYAML-6.0.1-cp310-cp310-win32.whl", hash = "sha256:bd4af7373a854424dabd882decdc5579653d7868b8fb26dc7d0e99f823aa5924"}, {file = "PyYAML-6.0.1-cp310-cp310-win_amd64.whl", hash = "sha256:fd1592b3fdf65fff2ad0004b5e363300ef59ced41c2e6b3a99d4089fa8c5435d"}, {file = "PyYAML-6.0.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:6965a7bc3cf88e5a1c3bd2e0b5c22f8d677dc88a455344035f03399034eb3007"}, {file = "PyYAML-6.0.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:f003ed9ad21d6a4713f0a9b5a7a0a79e08dd0f221aff4525a2be4c346ee60aab"}, {file = "PyYAML-6.0.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:42f8152b8dbc4fe7d96729ec2b99c7097d656dc1213a3229ca5383f973a5ed6d"}, {file = "PyYAML-6.0.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:062582fca9fabdd2c8b54a3ef1c978d786e0f6b3a1510e0ac93ef59e0ddae2bc"}, {file = "PyYAML-6.0.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d2b04aac4d386b172d5b9692e2d2da8de7bfb6c387fa4f801fbf6fb2e6ba4673"}, {file = "PyYAML-6.0.1-cp311-cp311-win32.whl", hash = "sha256:1635fd110e8d85d55237ab316b5b011de701ea0f29d07611174a1b42f1444741"}, {file = "PyYAML-6.0.1-cp311-cp311-win_amd64.whl", hash = "sha256:bf07ee2fef7014951eeb99f56f39c9bb4af143d8aa3c21b1677805985307da34"}, {file = "PyYAML-6.0.1-cp36-cp36m-macosx_10_9_x86_64.whl", hash = "sha256:50550eb667afee136e9a77d6dc71ae76a44df8b3e51e41b77f6de2932bfe0f47"}, {file = "PyYAML-6.0.1-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1fe35611261b29bd1de0070f0b2f47cb6ff71fa6595c077e42bd0c419fa27b98"}, {file = "PyYAML-6.0.1-cp36-cp36m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:704219a11b772aea0d8ecd7058d0082713c3562b4e271b849ad7dc4a5c90c13c"}, {file = "PyYAML-6.0.1-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:afd7e57eddb1a54f0f1a974bc4391af8bcce0b444685d936840f125cf046d5bd"}, {file = "PyYAML-6.0.1-cp36-cp36m-win32.whl", hash = "sha256:fca0e3a251908a499833aa292323f32437106001d436eca0e6e7833256674585"}, {file = "PyYAML-6.0.1-cp36-cp36m-win_amd64.whl", hash = "sha256:f22ac1c3cac4dbc50079e965eba2c1058622631e526bd9afd45fedd49ba781fa"}, {file = "PyYAML-6.0.1-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:b1275ad35a5d18c62a7220633c913e1b42d44b46ee12554e5fd39c70a243d6a3"}, {file = "PyYAML-6.0.1-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:18aeb1bf9a78867dc38b259769503436b7c72f7a1f1f4c93ff9a17de54319b27"}, {file = "PyYAML-6.0.1-cp37-cp37m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:596106435fa6ad000c2991a98fa58eeb8656ef2325d7e158344fb33864ed87e3"}, {file = "PyYAML-6.0.1-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:baa90d3f661d43131ca170712d903e6295d1f7a0f595074f151c0aed377c9b9c"}, {file = "PyYAML-6.0.1-cp37-cp37m-win32.whl", hash = "sha256:9046c58c4395dff28dd494285c82ba00b546adfc7ef001486fbf0324bc174fba"}, {file = "PyYAML-6.0.1-cp37-cp37m-win_amd64.whl", hash = "sha256:4fb147e7a67ef577a588a0e2c17b6db51dda102c71de36f8549b6816a96e1867"}, {file = "PyYAML-6.0.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:1d4c7e777c441b20e32f52bd377e0c409713e8bb1386e1099c2415f26e479595"}, {file = "PyYAML-6.0.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a0cd17c15d3bb3fa06978b4e8958dcdc6e0174ccea823003a106c7d4d7899ac5"}, {file = "PyYAML-6.0.1-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:28c119d996beec18c05208a8bd78cbe4007878c6dd15091efb73a30e90539696"}, {file = "PyYAML-6.0.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7e07cbde391ba96ab58e532ff4803f79c4129397514e1413a7dc761ccd755735"}, {file = "PyYAML-6.0.1-cp38-cp38-win32.whl", hash = "sha256:184c5108a2aca3c5b3d3bf9395d50893a7ab82a38004c8f61c258d4428e80206"}, {file = "PyYAML-6.0.1-cp38-cp38-win_amd64.whl", hash = "sha256:1e2722cc9fbb45d9b87631ac70924c11d3a401b2d7f410cc0e3bbf249f2dca62"}, {file = "PyYAML-6.0.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:9eb6caa9a297fc2c2fb8862bc5370d0303ddba53ba97e71f08023b6cd73d16a8"}, {file = "PyYAML-6.0.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:c8098ddcc2a85b61647b2590f825f3db38891662cfc2fc776415143f599bb859"}, {file = "PyYAML-6.0.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5773183b6446b2c99bb77e77595dd486303b4faab2b086e7b17bc6bef28865f6"}, {file = "PyYAML-6.0.1-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:b786eecbdf8499b9ca1d697215862083bd6d2a99965554781d0d8d1ad31e13a0"}, {file = "PyYAML-6.0.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bc1bf2925a1ecd43da378f4db9e4f799775d6367bdb94671027b73b393a7c42c"}, {file = "PyYAML-6.0.1-cp39-cp39-win32.whl", hash = "sha256:faca3bdcf85b2fc05d06ff3fbc1f83e1391b3e724afa3feba7d13eeab355484c"}, {file = "PyYAML-6.0.1-cp39-cp39-win_amd64.whl", hash = "sha256:510c9deebc5c0225e8c96813043e62b680ba2f9c50a08d3724c7f28a747d1486"}, {file = "PyYAML-6.0.1.tar.gz", hash = "sha256:bfdf460b1736c775f2ba9f6a92bca30bc2095067b8a9d77876d1fad6cc3b4a43"}, ] [[package]] name = "requests" version = "2.31.0" description = "Python HTTP for Humans." category = "main" optional = false python-versions = ">=3.7" files = [ {file = "requests-2.31.0-py3-none-any.whl", hash = "sha256:58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f"}, {file = "requests-2.31.0.tar.gz", hash = "sha256:942c5a758f98d790eaed1a29cb6eefc7ffb0d1cf7af05c3d2791656dbd6ad1e1"}, ] [package.dependencies] certifi = ">=2017.4.17" charset-normalizer = ">=2,<4" idna = ">=2.5,<4" urllib3 = ">=1.21.1,<3" [package.extras] socks = ["PySocks (>=1.5.6,!=1.5.7)"] use-chardet-on-py3 = ["chardet (>=3.0.2,<6)"] [[package]] name = "toml" version = "0.10.2" description = "Python Library for Tom's Obvious, Minimal Language" category = "dev" optional = false python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*" files = [ {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"}, {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"}, ] [[package]] name = "urllib3" version = "2.0.4" description = "HTTP library with thread-safe connection pooling, file post, and more." category = "main" optional = false python-versions = ">=3.7" files = [ {file = "urllib3-2.0.4-py3-none-any.whl", hash = "sha256:de7df1803967d2c2a98e4b11bb7d6bd9210474c46e8a0401514e3a42a75ebde4"}, {file = "urllib3-2.0.4.tar.gz", hash = "sha256:8d22f86aae8ef5e410d4f539fde9ce6b2113a001bb4d189e0aed70642d602b11"}, ] [package.extras] brotli = ["brotli (>=1.0.9)", "brotlicffi (>=0.8.0)"] secure = ["certifi", "cryptography (>=1.9)", "idna (>=2.0.0)", "pyopenssl (>=17.1.0)", "urllib3-secure-extra"] socks = ["pysocks (>=1.5.6,!=1.5.7,<2.0)"] zstd = ["zstandard (>=0.18.0)"] [[package]] name = "wcwidth" version = "0.2.6" description = "Measures the displayed width of unicode strings in a terminal" category = "main" optional = false python-versions = "*" files = [ {file = "wcwidth-0.2.6-py2.py3-none-any.whl", hash = "sha256:795b138f6875577cd91bba52baf9e445cd5118fd32723b460e30a0af30ea230e"}, {file = "wcwidth-0.2.6.tar.gz", hash = "sha256:a5220780a404dbe3353789870978e472cfe477761f06ee55077256e509b156d0"}, ] [metadata] lock-version = "2.0" python-versions = "^3.8" content-hash = "f578bbed6056c7a0f49650db776b9635ce5a76c248e2f86683380a011b266143" sigma-cli-0.7.7/print-coverage.py000066400000000000000000000006741447403454200167070ustar00rootroot00000000000000# Prints code testing coverage as percentage for badge generation. import xml.etree.ElementTree as et tree = et.parse("cov.xml") root = tree.getroot() coverage = float(root.attrib["line-rate"]) * 100 print(f"COVERAGE={coverage:3.4}%") if coverage >= 95.0: print("COVERAGE_COLOR=green") elif coverage >= 90.0: print("COVERAGE_COLOR=yellow") elif coverage >= 85.0: print("COVERAGE_COLOR=orange") else: print("COVERAGE_COLOR=red")sigma-cli-0.7.7/pyproject.toml000066400000000000000000000017721447403454200163240ustar00rootroot00000000000000[tool.poetry] name = "sigma-cli" version = "0.7.7" description = "Sigma Command Line Interface (conversion, check etc.) based on pySigma" authors = ["Thomas Patzke "] license = "LGPL-2.1-or-later" readme = "README.md" repository = "https://github.com/SigmaHQ/sigma-cli" classifiers = [ "Development Status :: 4 - Beta", "Intended Audience :: System Administrators", "License :: OSI Approved :: GNU Lesser General Public License v2 (LGPLv2)", "Programming Language :: Python :: 3.8", "Programming Language :: Python :: 3.9", "Programming Language :: Python :: 3.10", "Topic :: Security" ] packages = [ { include = "sigma" } ] [tool.poetry.dependencies] python = "^3.8" click = "^8.0.3" prettytable = "^3.1.1" pysigma = "^0.10.4" colorama = "^0.4.6" [tool.poetry.dev-dependencies] pytest = "^6.2.2" pytest-cov = "^2.11.1" [tool.poetry.scripts] sigma = "sigma.cli.main:main" [build-system] requires = ["poetry-core>=1.0.0"] build-backend = "poetry.core.masonry.api" sigma-cli-0.7.7/sigma/000077500000000000000000000000001447403454200145015ustar00rootroot00000000000000sigma-cli-0.7.7/sigma/analyze/000077500000000000000000000000001447403454200161445ustar00rootroot00000000000000sigma-cli-0.7.7/sigma/analyze/attack.py000066400000000000000000000033541447403454200177720ustar00rootroot00000000000000from typing import Callable, Dict, Iterable, List from sigma.rule import SigmaRule, SigmaLevel from sigma.collection import SigmaCollection from collections import defaultdict def score_count(rules : Iterable[SigmaRule]) -> int: """Return count of rules.""" return len(list(rules)) def score_max(rules : Iterable[SigmaRule]) -> int: """Return maximum rule level value.""" return max(map(lambda rule: rule.level.value if rule.level is not None else 0, rules)) rule_level_scores = { None: 1, SigmaLevel.INFORMATIONAL: 1, SigmaLevel.LOW: 2, SigmaLevel.MEDIUM: 4, SigmaLevel.HIGH: 8, SigmaLevel.CRITICAL: 12, } def rule_score(rule : SigmaRule) -> int: """Calculate rule score according to rule_level_scores.""" return rule_level_scores[rule.level] def score_level(rules : Iterable[SigmaRule]) -> int: return sum(map(rule_score, rules)) score_functions = { "count": (score_count, "Count of rules"), "max": (score_max, "Maximum severity value"), "level": (score_level, "Summarized level score"), } def calculate_attack_scores( rules : SigmaCollection, score_function : Callable[[Iterable[SigmaRule]], int], no_subtechniques : bool = False ) -> Dict[str, int]: """Generate MITRE™️ ATT&CK Navigator heatmap according to scoring function.""" attack_rules = defaultdict(list) for rule in rules: for tag in rule.tags: if tag.namespace == "attack": technique = tag.name.upper() if no_subtechniques: technique = technique.split(".")[0] attack_rules[technique].append(rule) return { attack: score_function(rules) for attack, rules in attack_rules.items() }sigma-cli-0.7.7/sigma/cli/000077500000000000000000000000001447403454200152505ustar00rootroot00000000000000sigma-cli-0.7.7/sigma/cli/analyze.py000066400000000000000000000060011447403454200172620ustar00rootroot00000000000000import json import pathlib import click from sigma.cli.rules import load_rules from sigma.analyze.attack import score_functions, calculate_attack_scores from sigma.data.mitre_attack import mitre_attack_techniques_tactics_mapping, mitre_attack_version @click.group(name="analyze", help="Analyze Sigma rule sets") def analyze_group(): pass @analyze_group.command( name="attack", help="Create MITRE™️ ATT&CK heatmaps from Sigma rule set. Score functions are: " + ", ".join(( f"{definition[1]} ({func})" for func, definition in score_functions.items() )) ) @click.option( "--file-pattern", "-P", default="*.yml", show_default=True, help="Pattern for file names to be included in recursion into directories.", ) @click.option( "--subtechniques/--no-subtechniques", "-s/-S", default=True, ) @click.option( "--max-color", "-c", default="#ff0000", show_default=True, help="Color used for maximum score." ) @click.option( "--min-color", "-C", default="#ffffff00", show_default=True, help="Color used for zero score." ) @click.option( "--max-score", "-m", type=int, default=None, help="Set fixed maximum score. All scores above are rendered as maximum. Increases color scale resolution for scores below.", ) @click.option( "--min-score", "-M", type=int, default="0", show_default=True, help="Minimum score. All scores below are not explicitly colored.", ) @click.argument( "function", type=click.Choice(score_functions.keys()), ) @click.argument( "output", type=click.File("w"), ) @click.argument( "input", nargs=-1, required=True, type=click.Path(exists=True, allow_dash=True, path_type=pathlib.Path), ) def analyze_attack(file_pattern, subtechniques, max_color, min_color, max_score, min_score, function, output, input): rules = load_rules(input, file_pattern) score_function = score_functions[function][0] scores = calculate_attack_scores(rules, score_function, not subtechniques) layer_techniques = [ { "techniqueID": technique, "tactic": tactic, "score": score, "color": "", "comment": "", "enabled": True, "metadata": [], "links": [], "showSubtechniques": False, } for technique, score in scores.items() for tactic in mitre_attack_techniques_tactics_mapping.get(technique, []) ] layer = { "name": "layer", "versions": { "attack": mitre_attack_version, "navigator": "4.8.1", "layer": "4.4" }, "domain": "enterprise-attack", "description": f"Sigma coverage heatmap generated by Sigma CLI with score function {function}", "gradient": { "colors": [ min_color, max_color, ], "minValue": min_score, "maxValue": max_score or max(scores.values()) }, "techniques": layer_techniques, } json.dump(layer, output, indent=2)sigma-cli-0.7.7/sigma/cli/check.py000066400000000000000000000130421447403454200166770ustar00rootroot00000000000000import pathlib from textwrap import fill import click from collections import Counter from prettytable import PrettyTable from sys import stderr from sigma.exceptions import SigmaConditionError, SigmaError from sigma.cli.rules import load_rules from sigma.validation import SigmaValidator from sigma.plugins import InstalledSigmaPlugins plugins = InstalledSigmaPlugins.autodiscover() validators = plugins.validators @click.command() @click.option( "--validation-config", "-c", type=click.File("r"), help="Validation configuration file in YAML format.", ) @click.option( "--file-pattern", "-P", default="*.yml", show_default=True, help="Pattern for file names to be included in recursion into directories.", ) @click.option( "--fail-on-error/--pass-on-error", "-e/-E", default=True, show_default=True, help="Fail on Sigma rule parsing errors.", ) @click.option( "--fail-on-issues/--pass-on-issues", "-i/-I", default=False, show_default=True, help="Fail on Sigma rule validation issues.", ) @click.argument( "input", nargs=-1, required=True, type=click.Path(exists=True, allow_dash=True, path_type=pathlib.Path), ) def check(input, validation_config, file_pattern, fail_on_error, fail_on_issues): """Check Sigma rules for validity and best practices (not yet implemented).""" if validation_config is None: # no validation config provided, use basic config with all validators rule_validator = SigmaValidator(validators.values()) else: rule_validator = SigmaValidator.from_yaml(validation_config.read(), validators) try: rule_collection = load_rules(input, file_pattern) rule_errors = Counter() cond_errors = Counter() check_rules = list() first_error = True for rule in rule_collection.rules: if len(rule.errors) > 0: # rule has errors: print errors and skip further checking of rule if first_error: click.echo("=== Sigma Rule Errors ===") first_error = False for error in rule.errors: click.echo(error) rule_errors.update((error.__class__.__name__,)) else: # rule has no errors, parse condition try: for condition in rule.detection.parsed_condition: condition.parse() check_rules.append(rule) except SigmaConditionError as e: # Error in condition error = str(e) click.echo(f"Condition error in { str(condition.source) }:{ error }") cond_errors.update((error,)) # TODO: From Python 3.10 the commented line below can be used. rule_error_count = sum(rule_errors.values()) #rule_error_count = rule_errors.total() with click.progressbar(check_rules, label="Checking Sigma rules", file=stderr) as rules: issues = rule_validator.validate_rules(rules) issue_count = len(issues) issue_counter = Counter() if issue_count > 0: click.echo("=== Issues ===") for issue in issues: click.echo(issue) issue_counter.update((issue.__class__,)) # TODO: From Python 3.10 the commented line below can be used. cond_error_count = sum(cond_errors.values()) #cond_error_count = cond_errors.total() click.echo() click.echo("=== Summary ===") click.echo(f"Found {rule_error_count} errors, { cond_error_count } condition errors and { issue_count } issues.") if rule_error_count > 0: click.echo("\nRule error summary:") rule_error_table = PrettyTable( field_names=("Count", "Rule Error"), align="l", ) rule_error_table.add_rows([ (count, fill(error, width=60)) for error, count in sorted(rule_errors.items(), key=lambda item: item[1], reverse=True) ]) click.echo(rule_error_table.get_string()) else: click.echo("No rule errors found.") if cond_error_count > 0: click.echo("\nCondition error summary:") cond_error_table = PrettyTable( field_names=("Count", "Condition Error"), align="l", ) cond_error_table.add_rows([ (count, fill(error, width=60)) for error, count in sorted(cond_errors.items(), key=lambda item: item[1], reverse=True) ]) click.echo(cond_error_table.get_string()) else: click.echo("No condition errors found.") if issue_count > 0: click.echo("\nValidation issue summary:") validation_issue_summary = PrettyTable( field_names=("Count", "Issue", "Severity", "Description"), align="l", ) validation_issue_summary.add_rows([ (count, issue.__name__, issue.severity.name, fill(issue.description, width=60)) for issue, count in sorted(issue_counter.items(), key=lambda item: item[1], reverse=True) ]) click.echo(validation_issue_summary.get_string()) else: click.echo("No validation issues found.") if fail_on_error and rule_error_count > 0 or fail_on_issues and issue_count > 0: click.get_current_context().exit(1) except SigmaError as e: click.echo("Check error: " + str(e), err=True) sigma-cli-0.7.7/sigma/cli/convert.py000066400000000000000000000217251447403454200173110ustar00rootroot00000000000000from genericpath import exists import json import pathlib import textwrap from typing import Any, Optional, Sequence import click from sigma.conversion.base import Backend from sigma.collection import SigmaCollection from sigma.exceptions import SigmaError, SigmaPipelineNotAllowedForBackendError, SigmaPipelineNotFoundError from sigma.cli.rules import load_rules from sigma.plugins import InstalledSigmaPlugins plugins = InstalledSigmaPlugins.autodiscover() backends = plugins.backends pipelines = plugins.pipelines pipeline_resolver = plugins.get_pipeline_resolver() pipeline_list = list(pipeline_resolver.pipelines.keys()) class KeyValueParamType(click.ParamType): """ key=value type for backend-specific options. """ name = "key-value" def convert(self, value, param, ctx): if not isinstance(value, str): self.fail(f"Value must be a string with format key=value", param, ctx) try: k, v = value.split("=", 1) except ValueError: self.fail(f"Value '{value}' has not format key=value", param, ctx) try: return { k: int(v) } except ValueError: return { k: v } class ChoiceWithPluginHint(click.Choice): """Custom base class that shows a command line for listing the appropriate plugins if user tries to use an unknown backend or pipeline.""" def __init__(self, choices: Sequence[str], plugin_type : str, case_sensitive: bool = True) -> None: self.plugin_type = plugin_type super().__init__(choices, case_sensitive) def fail(self, message : str, param, ctx): return super().fail(message + " - run " + click.style(f"sigma plugin list --plugin-type {self.plugin_type}", bold=True, fg="green") + " for a list of available plugins.", param, ctx) @click.command() @click.option( "--target", "-t", type=ChoiceWithPluginHint(backends.keys(), "backend"), required=True, help="Target query language (" + click.style("sigma list targets", bold=True, fg="green") + ")", ) @click.option( "--pipeline", "-p", multiple=True, help="Specify processing pipelines as identifiers (" + click.style("sigma list pipelines", bold=True, fg="green") + ") or YAML files", ) @click.option( "--without-pipeline", is_flag=True, default=False, help="Proceed with conversion without processing pipeline, even if it is mandatory for the target.", ) @click.option( "--pipeline-check/--disable-pipeline-check", default=True, help="Verify if a pipeline is used that is intended for another backend.", ) @click.option( "--format", "-f", default="default", show_default=True, help="Select backend output format", ) @click.option( "--file-pattern", "-P", default="*.yml", show_default=True, help="Pattern for file names to be included in recursion into directories.", ) @click.option( "--skip-unsupported/--fail-unsupported", "-s/", default=False, help="Skip conversion of rules that can't be handled by the backend", ) @click.option( "--output", "-o", type=click.File("wb"), default="-", show_default=True, help="Write result to specified file. '-' writes to standard output." ) @click.option( "--encoding", "-e", type=str, default="utf-8", show_default=True, help="Output encoding for string backend outputs. This is ignored for backends that return binary output." ) @click.option( "--json-indent", "-j", type=int, default=None, help="Pretty-print and indent JSON output with given indentation width per level." ) @click.option( "--backend-option", "-O", type=KeyValueParamType(), multiple=True, help="Backend-specific options provided as key=value pair.", ) @click.argument( "input", nargs=-1, required=True, type=click.Path(exists=True, allow_dash=True, path_type=pathlib.Path), ) def convert(target, pipeline, without_pipeline, pipeline_check, format, skip_unsupported, output, encoding, json_indent, backend_option, input, file_pattern): """ Convert Sigma rules into queries. INPUT can be multiple files or directories. This command automatically recurses into directories and converts all files matching the pattern in --file-pattern. """ # Check if pipeline is required if backends[target].requires_pipeline \ and pipeline == () \ and not without_pipeline: raise click.UsageError(textwrap.dedent(f""" Processing pipeline required by backend! Define a custom pipeline or choose a predefined one. Get all available pipelines for {target} with: """ + click.style(f"sigma list pipelines {target}", bold=True, fg="green") + """ If you never heard about processing pipelines you should get familiar with them (https://sigmahq-pysigma.readthedocs.io/en/latest/Processing_Pipelines.html). If you know what you're doing add --without-pipeline to your command line to suppress this error. """)) # Merge backend options: multiple occurences of a key result in array of values backend_options = dict() for option in backend_option: for k, v in option.items(): backend_options.setdefault(k, list()).append(v) backend_options = { k: ( v[0] # if there's only one item, return it. if len(v) == 1 else v ) for k, v in backend_options.items() } # Initialize processing pipeline and backend backend_class = backends[target] try: processing_pipeline = pipeline_resolver.resolve(pipeline, target if pipeline_check else None) except SigmaPipelineNotFoundError as e: raise click.UsageError( f"The pipeline '{e.spec}' was not found.\n" + "List all installed processing pipelines with: " + click.style(f"sigma list pipelines {target}", bold=True, fg="green") + "\n" "List pipeline plugins for installation with: " + click.style(f"sigma plugin list --plugin-type pipeline", bold=True, fg="green") + "\n" + "Pipelines not listed here are treated as file names." ) except SigmaPipelineNotAllowedForBackendError as e: raise click.UsageError(textwrap.dedent(f""" The pipeline '{e.wrong_pipeline}' is not intended to be used with the target {target}. You can list all pipelines that are intended to be used with this target with """ + \ click.style(f"sigma list pipelines {target}", bold=True, fg="green") + """. If you know what you're doing and want to use this pipeline(s) in this conversion, disable this check with --disable-pipeline-check. """)) try: backend : Backend = backend_class( processing_pipeline=processing_pipeline, collect_errors=skip_unsupported, **backend_options ) except TypeError as e: param = str(e).split("'")[1] raise click.BadParameter(f"Parameter '{param}' is not supported by backend '{target}'.", param_hint="backend_option") if format not in backends[target].formats.keys(): raise click.BadParameter(f"Output format '{format}' is not supported by backend '{target}'. Run " + click.style(f"sigma list formats {target}", bold=True, fg="green") + " to list all available formats of the target.", param_hint="format") try: rule_collection = load_rules(input, file_pattern) result = backend.convert(rule_collection, format) if isinstance(result, str): # String result click.echo(bytes(result, encoding), output) elif isinstance(result, bytes): # Bytes result: only allow to write it to file. if output.isatty(): raise click.UsageError("Backend returns binary output. Please provide output file with --output/-o.") else: click.echo(result, output) elif isinstance(result, list) and all(( # List of strings Concatenate with newlines in between. isinstance(item, str) for item in result )): click.echo(bytes("\n\n".join(result), encoding), output) elif isinstance(result, list) and all(( # List of dicts: concatenate with newline and render each result als JSON. isinstance(item, dict) for item in result )): click.echo(bytes("\n".join(( json.dumps(item, indent=json_indent) for item in result )), encoding), output) elif isinstance(result, dict): click.echo(bytes(json.dumps(result, indent=json_indent), encoding)) else: click.echo(f"Backend returned unexpected format {str(type(result))}", err=True) except SigmaError as e: click.echo("Error while conversion: " + str(e), err=True) if len(backend.errors) > 0: click.echo("\nIgnored errors:", err=True) for rule, error in backend.errors: click.echo(f"{str(rule.source)}: {str(error)}", err=True)sigma-cli-0.7.7/sigma/cli/list.py000066400000000000000000000116671447403454200166100ustar00rootroot00000000000000import click from sigma.plugins import InstalledSigmaPlugins from sigma.modifiers import modifier_mapping from sigma.processing.transformations import transformations from sigma.processing.conditions import rule_conditions, detection_item_conditions, field_name_conditions from prettytable import PrettyTable from textwrap import dedent, fill plugins = InstalledSigmaPlugins.autodiscover() @click.group(name="list", help="List available targets or processing pipelines.") def list_group(): pass @list_group.command(name="targets", help="List conversion target query languages.") def list_targets(): if len(plugins.backends) == 0: click.echo("No backends installed. Use " + click.style("sigma plugin list", bold=True, fg="green") + " to list available plugins.") else: table = PrettyTable() table.field_names = ("Identifier", "Target Query Language", "Processing Pipeline Required") table.add_rows([ (name, fill(backend.name, width=60), "Yes" if backend.requires_pipeline else "No") for name, backend in plugins.backends.items() ]) table.align = "l" click.echo(table.get_string()) @list_group.command(name="formats", help="List formats supported by specified conversion backend.") @click.argument( "backend", type=click.Choice(plugins.backends.keys()), ) def list_formats(backend): table = PrettyTable() table.field_names = ("Format", "Description") table.add_rows([ (name, fill(description, width=60)) for name, description in plugins.backends[backend].formats.items() ]) table.align = "l" click.echo(table.get_string()) @list_group.command(name="pipelines", help="List processing pipelines.") @click.argument( "backend", required=False, type=click.Choice(plugins.backends.keys()) ) def list_pipelines(backend): pipeline_resolver = plugins.get_pipeline_resolver() pipelines = list(pipeline_resolver.list_pipelines()) if len(pipelines) == 0: click.echo("No pipelines. Use " + click.style("sigma plugin list", bold=True, fg="green") + " to list available plugins.") else: table = PrettyTable() table.field_names = ("Identifier", "Priority", "Processing Pipeline", "Backends") for name, pipeline in pipelines: if backend is None or backend in pipeline.allowed_backends or len(pipeline.allowed_backends) == 0: if len(pipeline.allowed_backends) > 0: backends = ", ".join(pipeline.allowed_backends) else: backends = "all" table.add_row((name, pipeline.priority, fill(pipeline.name, width=60), backends)) table.align = "l" click.echo(table.get_string()) @list_group.command(name="validators", help="List rule validators.") def list_validators(): table = PrettyTable( field_names=("Name", "Description",), align="l", ) table.add_rows([ (name, fill(dedent(validator.__doc__ or "-").strip(), width=60)) for name, validator in plugins.validators.items() ]) click.echo(table.get_string()) @list_group.command(name="modifiers", help="List Sigma rule value modifiers.") def list_modifiers(): table = PrettyTable( field_names=("Modifier", "Description",), align="l", ) modifier_classes = [] for cls in modifier_mapping.values(): if not cls in modifier_classes: modifier_classes.append(cls) modifiers = [ (" / ".join( modifier for modifier, c in modifier_mapping.items() if c == cls ), cls) for cls in modifier_classes ] table.add_rows([ (modifier, fill(dedent(cls.__doc__ or "-").strip(), width=60)) for modifier, cls in modifiers # modifier_mapping.items() ]) click.echo(table.get_string()) @list_group.command(name="transformations", help="List processing pipeline transformations.") def list_transformations(): table = PrettyTable( field_names=("Transformation", "Description",), align="l", ) table.add_rows([ (name, fill(dedent(cls.__doc__ or "-").strip(), width=60)) for name, cls in transformations.items() ]) click.echo(table.get_string()) @list_group.command(name="conditions", help="List processing pipeline conditions.") def list_conditions(): table = PrettyTable( field_names=("Type", "Condition", "Description",), align="l", ) table.add_rows([ ("Rule", name, fill(dedent(cls.__doc__ or "-").strip(), width=60)) for name, cls in rule_conditions.items() ]) table.add_rows([ ("Detection Item", name, fill(dedent(cls.__doc__ or "-").strip(), width=60)) for name, cls in detection_item_conditions.items() ]) table.add_rows([ ("Field Name", name, fill(dedent(cls.__doc__ or "-").strip(), width=60)) for name, cls in field_name_conditions.items() ]) click.echo(table.get_string())sigma-cli-0.7.7/sigma/cli/main.py000066400000000000000000000022431447403454200165470ustar00rootroot00000000000000import click import sys try: import sigma.parser.base click.echo(click.style("ERROR:", bold=True, fg="red") + click.style(" the legacy 'sigmatools' package is installed in the same Python environment as Sigma CLI and pySigma. This can cause unexpected errors!", fg="red")) click.echo(click.style("Please uninstall 'sigmatools' from this Python environment!", fg="red")) click.echo(click.style("It is strogly recommended to install Sigma CLI with pipx (https://pypa.github.io/pipx/) to ensure a clean environment.", fg="green")) sys.exit(100) except ImportError: pass import pkg_resources from .list import list_group from .convert import convert from .check import check from .plugin import plugin_group from .analyze import analyze_group @click.group() def cli(): pass @click.command() def version(): """Print version of Sigma CLI.""" click.echo(pkg_resources.get_distribution("sigma-cli").version) def main(): cli.add_command(analyze_group) cli.add_command(plugin_group) cli.add_command(list_group) cli.add_command(convert) cli.add_command(check) cli.add_command(version) cli() if __name__ == "__main__": main()sigma-cli-0.7.7/sigma/cli/plugin.py000066400000000000000000000072211447403454200171220ustar00rootroot00000000000000from typing import List import click from sigma.plugins import SigmaPluginDirectory, SigmaPluginType, SigmaPluginState, SigmaPlugin from sigma.exceptions import SigmaPluginNotFoundError from prettytable import PrettyTable from textwrap import fill @click.group(name="plugin", help="pySigma plugin management (backends, processing pipelines and validators).") def plugin_group(): pass @plugin_group.command(name="list", help="List installable plugins.") @click.option("--plugin-type", "-t", type=click.Choice([ str(item) for item in SigmaPluginType ], case_sensitive=False), help="Display only plugins of given type.") @click.option("--plugin-state", "-s", type=click.Choice([ str(item) for item in SigmaPluginState ], case_sensitive=False), help="Display only plugins with given state.") @click.option("--compatible", "-c", is_flag=True, help="Show only plugins that are compatible with the installed pySigma version.") @click.argument("search", default="") def list_plugins(plugin_type : str, plugin_state : str, compatible : bool, search : str): plugins = SigmaPluginDirectory.default_plugin_directory() compatibility_state = { True: "yes", False: "no", None: "unknown", } get_plugins_args = dict() if plugin_type: get_plugins_args["plugin_types"] = { SigmaPluginType[ plugin_type.upper() ]} if plugin_state: get_plugins_args["plugin_states"] = { SigmaPluginState[ plugin_state.upper() ]} norm_search = search.lower() table = PrettyTable() table.field_names = ("Identifier", "Type", "State", "Description", "Compatible?") table.add_rows([ (plugin.id, str(plugin.type), str(plugin.state), fill(plugin.description, width=60), compatibility_state[plugin.is_compatible()]) for plugin in plugins.get_plugins(compatible_only=compatible, **get_plugins_args) if norm_search in plugin.id.lower() or norm_search in plugin.description.lower() ]) table.align = "l" click.echo(table.get_string()) def get_plugin(uuid : bool, plugin_identifier : str) -> SigmaPlugin: plugins = SigmaPluginDirectory.default_plugin_directory() try: if uuid: return plugins.get_plugin_by_uuid(plugin_identifier) else: return plugins.get_plugin_by_id(plugin_identifier) except SigmaPluginNotFoundError as e: raise click.exceptions.ClickException(str(e)) @plugin_group.command(name="install", help="Install plugin by identifier or UUID.") @click.option("--uuid", "-u", is_flag=True, help="Install plugin by UUID.") @click.option("--compatibility-check/--no-compatibility-check", "-c/-C", default=True, help="Enable or disable plugin compatibility check.") @click.argument("plugin-identifiers", nargs=-1) def install_plugin(uuid : bool, compatibility_check : bool, plugin_identifiers : List[str]): for plugin_identifier in plugin_identifiers: plugin = get_plugin(uuid, plugin_identifier) if not compatibility_check or plugin.is_compatible(): plugin.install() click.echo(f"Successfully installed plugin '{plugin_identifier}'") else: raise click.exceptions.ClickException("Plugin not compatible with installed pySigma version!") @plugin_group.command(name="uninstall", help="Uninstall plugin by identifier or UUID.") @click.option("--uuid", "-u", is_flag=True, help="Uninstall plugin by UUID.") @click.argument("plugin-identifiers", nargs=-1) def uninstall_plugin(uuid : bool, plugin_identifiers : List[str]): for plugin_identifier in plugin_identifiers: plugin = get_plugin(uuid, plugin_identifier) plugin.uninstall() click.echo(f"Successfully uninstalled plugin '{plugin_identifier}'")sigma-cli-0.7.7/sigma/cli/rules.py000066400000000000000000000013571447403454200167620ustar00rootroot00000000000000from pathlib import Path from sys import stderr import click from sigma.collection import SigmaCollection def load_rules(input, file_pattern): if len(input) == 1 and input[0] == Path("-"): # read rule from standard input rule_collection = SigmaCollection.from_yaml(click.get_text_stream("stdin")) else: rule_paths = SigmaCollection.resolve_paths( input, recursion_pattern="**/" + file_pattern, ) with click.progressbar(list(rule_paths), label="Parsing Sigma rules", file=stderr) as progress_rule_paths: rule_collection = SigmaCollection.load_ruleset( progress_rule_paths, collect_errors=True, ) return rule_collection sigma-cli-0.7.7/test.json000066400000000000000000001242171447403454200152620ustar00rootroot00000000000000{ "name": "layer", "versions": { "attack": "13.1", "navigator": "4.8.1", "layer": "4.4" }, "domain": "enterprise-attack", "description": "Sigma coverage heatmap generated by Sigma CLI with score function max", "gradient": { "colors": [ "#f5fff5", "#00ff00" ], "minValue": 0, "maxValue": 5 }, "techniques": [ { "techniqueID": "T1190", "tactic": "initial-access", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1053", "tactic": "execution", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1053", "tactic": "persistence", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1053", "tactic": "privilege-escalation", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1033", "tactic": "discovery", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1021", "tactic": "lateral-movement", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1047", "tactic": "execution", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1112", "tactic": "defense-evasion", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1569", "tactic": "execution", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1087", "tactic": "discovery", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1203", "tactic": "execution", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1219", "tactic": "command-and-control", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1204", "tactic": "execution", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1003", "tactic": "credential-access", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1558", "tactic": "credential-access", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1055", "tactic": "defense-evasion", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1055", "tactic": "privilege-escalation", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1486", "tactic": "impact", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1588", "tactic": "resource-development", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1505", "tactic": "persistence", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1562", "tactic": "defense-evasion", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1070", "tactic": "defense-evasion", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1565", "tactic": "impact", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1020", "tactic": "exfiltration", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1059", "tactic": "execution", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1005", "tactic": "collection", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1537", "tactic": "exfiltration", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1525", "tactic": "persistence", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1485", "tactic": "impact", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1136", "tactic": "persistence", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1531", "tactic": "impact", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1580", "tactic": "discovery", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1592", "tactic": "reconnaissance", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1016", "tactic": "discovery", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1619", "tactic": "discovery", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1098", "tactic": "persistence", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1078", "tactic": "defense-evasion", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1078", "tactic": "persistence", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1078", "tactic": "privilege-escalation", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1078", "tactic": "initial-access", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1583", "tactic": "resource-development", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1548", "tactic": "privilege-escalation", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1548", "tactic": "defense-evasion", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1550", "tactic": "defense-evasion", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1550", "tactic": "lateral-movement", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1578", "tactic": "defense-evasion", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1556", "tactic": "credential-access", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1556", "tactic": "defense-evasion", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1556", "tactic": "persistence", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1110", "tactic": "credential-access", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1526", "tactic": "discovery", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1484", "tactic": "defense-evasion", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1484", "tactic": "privilege-escalation", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1489", "tactic": "impact", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1552", "tactic": "credential-access", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1528", "tactic": "credential-access", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1621", "tactic": "credential-access", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1074", "tactic": "collection", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1213", "tactic": "collection", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1195", "tactic": "initial-access", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1573", "tactic": "command-and-control", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1114", "tactic": "collection", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1199", "tactic": "initial-access", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1123", "tactic": "collection", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1027", "tactic": "defense-evasion", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1106", "tactic": "execution", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1222", "tactic": "defense-evasion", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1115", "tactic": "collection", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1068", "tactic": "privilege-escalation", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1560", "tactic": "collection", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1048", "tactic": "exfiltration", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1006", "tactic": "defense-evasion", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1574", "tactic": "persistence", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1574", "tactic": "privilege-escalation", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1574", "tactic": "defense-evasion", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1564", "tactic": "defense-evasion", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1056", "tactic": "collection", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1056", "tactic": "credential-access", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1547", "tactic": "persistence", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1547", "tactic": "privilege-escalation", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1036", "tactic": "defense-evasion", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1046", "tactic": "discovery", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1040", "tactic": "credential-access", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1040", "tactic": "discovery", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1201", "tactic": "discovery", "score": 2, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1543", "tactic": "persistence", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1543", "tactic": "privilege-escalation", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1113", "tactic": "collection", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1030", "tactic": "exfiltration", "score": 2, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1587", "tactic": "resource-development", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1584", "tactic": "resource-development", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1082", "tactic": "discovery", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1529", "tactic": "impact", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1546", "tactic": "privilege-escalation", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1546", "tactic": "persistence", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1105", "tactic": "command-and-control", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1212", "tactic": "credential-access", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1589", "tactic": "reconnaissance", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1567", "tactic": "exfiltration", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1568", "tactic": "command-and-control", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1572", "tactic": "command-and-control", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1090", "tactic": "command-and-control", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1102", "tactic": "command-and-control", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1140", "tactic": "defense-evasion", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1083", "tactic": "discovery", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1553", "tactic": "defense-evasion", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1069", "tactic": "discovery", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1057", "tactic": "discovery", "score": 2, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1018", "tactic": "discovery", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1518", "tactic": "discovery", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1071", "tactic": "command-and-control", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1593", "tactic": "reconnaissance", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1049", "tactic": "discovery", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1014", "tactic": "defense-evasion", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1037", "tactic": "persistence", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1037", "tactic": "privilege-escalation", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1555", "tactic": "credential-access", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1137", "tactic": "persistence", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1566", "tactic": "initial-access", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1124", "tactic": "discovery", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1495", "tactic": "impact", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1561", "tactic": "impact", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1490", "tactic": "impact", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1557", "tactic": "credential-access", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1557", "tactic": "collection", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1595", "tactic": "reconnaissance", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1496", "tactic": "impact", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1041", "tactic": "exfiltration", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1187", "tactic": "credential-access", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1095", "tactic": "command-and-control", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1571", "tactic": "command-and-control", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1210", "tactic": "lateral-movement", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1499", "tactic": "impact", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1590", "tactic": "reconnaissance", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1119", "tactic": "collection", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1189", "tactic": "initial-access", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1197", "tactic": "defense-evasion", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1197", "tactic": "persistence", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1211", "tactic": "defense-evasion", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1218", "tactic": "defense-evasion", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1072", "tactic": "execution", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1072", "tactic": "lateral-movement", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1200", "tactic": "initial-access", "score": 2, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1482", "tactic": "discovery", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1012", "tactic": "discovery", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1134", "tactic": "defense-evasion", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1134", "tactic": "privilege-escalation", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1091", "tactic": "lateral-movement", "score": 2, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1091", "tactic": "initial-access", "score": 2, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1554", "tactic": "persistence", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1570", "tactic": "lateral-movement", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1207", "tactic": "defense-evasion", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1010", "tactic": "discovery", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1133", "tactic": "persistence", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1133", "tactic": "initial-access", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1001", "tactic": "command-and-control", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1039", "tactic": "collection", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1127", "tactic": "defense-evasion", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1559", "tactic": "execution", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1599", "tactic": "defense-evasion", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1008", "tactic": "command-and-control", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1216", "tactic": "defense-evasion", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1542", "tactic": "defense-evasion", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1542", "tactic": "persistence", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1202", "tactic": "defense-evasion", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1220", "tactic": "defense-evasion", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1497", "tactic": "defense-evasion", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1497", "tactic": "discovery", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1217", "tactic": "discovery", "score": 2, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1615", "tactic": "discovery", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1491", "tactic": "impact", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1120", "tactic": "discovery", "score": 2, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1135", "tactic": "discovery", "score": 5, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1176", "tactic": "persistence", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1185", "tactic": "collection", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1614", "tactic": "discovery", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1132", "tactic": "command-and-control", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1563", "tactic": "lateral-movement", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1007", "tactic": "discovery", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1620", "tactic": "defense-evasion", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1104", "tactic": "command-and-control", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1539", "tactic": "credential-access", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1608", "tactic": "resource-development", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1125", "tactic": "collection", "score": 4, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false }, { "techniqueID": "T1221", "tactic": "defense-evasion", "score": 3, "color": "", "comment": "", "enabled": true, "metadata": [], "links": [], "showSubtechniques": false } ] }sigma-cli-0.7.7/tests/000077500000000000000000000000001447403454200145435ustar00rootroot00000000000000sigma-cli-0.7.7/tests/__init__.py000066400000000000000000000000001447403454200166420ustar00rootroot00000000000000sigma-cli-0.7.7/tests/files/000077500000000000000000000000001447403454200156455ustar00rootroot00000000000000sigma-cli-0.7.7/tests/files/custom_pipeline.yml000066400000000000000000000002311447403454200215630ustar00rootroot00000000000000name: Custom Pipeline priority: 100 transformations: - id: field_mapping type: field_name_mapping mapping: ParentImage: some_other_stringsigma-cli-0.7.7/tests/files/invalid/000077500000000000000000000000001447403454200172735ustar00rootroot00000000000000sigma-cli-0.7.7/tests/files/invalid/sigma_rule_with_condition_errors.yml000066400000000000000000000003671447403454200266500ustar00rootroot00000000000000title: Test rule id: 5013332f-8a70-4e04-bcc1-06a98a2cca2e logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: '\httpd.exe' Image|endswith: '\cmd.exe' condition: selection | count() > 5sigma-cli-0.7.7/tests/files/invalid/sigma_rule_with_errors.yml000066400000000000000000000002421447403454200245720ustar00rootroot00000000000000title: Test id: invalid level: invalid status: invalid date: invalid detections: detection: selection_1: Image|test: test.exe condition: selectionsigma-cli-0.7.7/tests/files/issues/000077500000000000000000000000001447403454200171605ustar00rootroot00000000000000sigma-cli-0.7.7/tests/files/issues/sigma_rule_wildcards_instead_of_endswith.yml000066400000000000000000000003311447403454200301630ustar00rootroot00000000000000title: Test rule id: 5013332f-8a70-4e04-bcc1-06a98a2cca2e logsource: category: process_creation product: windows detection: selection: ParentImage: '*\httpd.exe' Image: '*\cmd.exe' condition: selectionsigma-cli-0.7.7/tests/files/issues/sigma_rule_without_id.yml000066400000000000000000000003001447403454200242620ustar00rootroot00000000000000title: Test rule logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: '\httpd.exe' Image|endswith: '\cmd.exe' condition: selectionsigma-cli-0.7.7/tests/files/valid/000077500000000000000000000000001447403454200167445ustar00rootroot00000000000000sigma-cli-0.7.7/tests/files/valid/sigma_rule.yml000066400000000000000000000004201447403454200216120ustar00rootroot00000000000000title: Test rule id: 5013332f-8a70-4e04-bcc1-06a98a2cca2e level: high logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: '\httpd.exe' Image|endswith: '\cmd.exe' condition: selection tags: - attack.t1505.003sigma-cli-0.7.7/tests/files/validation_config.yml000066400000000000000000000002111447403454200220410ustar00rootroot00000000000000validators: - all - -tlptag - -tlpv1_tag exclusions: 5013332f-8a70-4e04-bcc1-06a98a2cca2e: wildcards_instead_of_modifierssigma-cli-0.7.7/tests/test_analyze.py000066400000000000000000000101041447403454200176130ustar00rootroot00000000000000import pytest from click.testing import CliRunner from sigma.cli.analyze import analyze_group, analyze_attack from sigma.rule import SigmaRule, SigmaLogSource, SigmaDetections, SigmaDetection, SigmaDetectionItem, SigmaLevel, SigmaRuleTag from sigma.analyze.attack import calculate_attack_scores, score_count, score_max, score_level, rule_level_scores, score_functions def test_analyze_group(): cli = CliRunner() result = cli.invoke(analyze_group, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 8 def test_attack_help(): cli = CliRunner() result = cli.invoke(analyze_attack, ["--help"]) assert result.exit_code == 0 for func in score_functions.keys(): assert func in result.stdout assert len(result.stdout.split()) > 8 def test_attack_generate(): cli = CliRunner() result = cli.invoke(analyze_attack, ["max", "-", "tests/files/valid"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 25 assert "T1505.003" in result.stdout assert "persistence" in result.stdout assert "#ff0000" in result.stdout assert "#ffffff00" in result.stdout assert '"maxValue": 4' in result.stdout assert '"minValue": 0' in result.stdout def test_attack_generate_max_value(): cli = CliRunner() result = cli.invoke(analyze_attack, ["--max-score", "2", "max", "-", "tests/files/valid"]) assert result.exit_code == 0 assert '"maxValue": 2' in result.stdout def test_attack_generate_min_value(): cli = CliRunner() result = cli.invoke(analyze_attack, ["--min-score", "2", "max", "-", "tests/files/valid"]) assert result.exit_code == 0 assert '"minValue": 2' in result.stdout def test_attack_generate_max_color(): cli = CliRunner() result = cli.invoke(analyze_attack, ["--max-color", "#123456", "max", "-", "tests/files/valid"]) assert result.exit_code == 0 assert "#123456" in result.stdout def test_attack_generate_min_color(): cli = CliRunner() result = cli.invoke(analyze_attack, ["--min-color", "#123456", "max", "-", "tests/files/valid"]) assert result.exit_code == 0 assert "#123456" in result.stdout def test_attack_generate_no_subtechniques(): cli = CliRunner() result = cli.invoke(analyze_attack, ["--no-subtechniques", "max", "-", "tests/files/valid"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 25 assert "T1505\"" in result.stdout assert "persistence" in result.stdout @pytest.fixture def sigma_rules(): logsource = SigmaLogSource("test") detections = SigmaDetections( { "test": SigmaDetection( [SigmaDetectionItem("field", [], "value")] ) }, ["test"] ) return [ SigmaRule("Medium severity rule", logsource, detections, level=SigmaLevel.MEDIUM, tags=[SigmaRuleTag("test", "tag"), SigmaRuleTag("attack", "t1234.001")]), SigmaRule("None severity rule", logsource, detections, tags=[SigmaRuleTag("attack", "t1234.001")]), SigmaRule("Low severity rule", logsource, detections, level=SigmaLevel.LOW), SigmaRule("Critical severity rule", logsource, detections, level=SigmaLevel.CRITICAL, tags=[SigmaRuleTag("attack", "t4321")]), SigmaRule("Informational severity rule", logsource, detections, level=SigmaLevel.INFORMATIONAL, tags=[SigmaRuleTag("attack", "t4321")]), SigmaRule("High severity rule", logsource, detections, level=SigmaLevel.HIGH, tags=[SigmaRuleTag("attack", "t4321")]), ] def test_attack_score_count(sigma_rules): assert score_count(sigma_rules) == 6 def test_attack_score_max(sigma_rules): assert score_max(sigma_rules) == 5 def test_attack_score_level(sigma_rules): assert score_level(sigma_rules) == sum(rule_level_scores.values()) def test_generate_attack_scores(sigma_rules): assert calculate_attack_scores(sigma_rules, score_count) == { "T1234.001": 2, "T4321": 3, } def test_generate_attack_scores_no_subtechniques(sigma_rules): assert calculate_attack_scores(sigma_rules, score_count, True) == { "T1234": 2, "T4321": 3, }sigma-cli-0.7.7/tests/test_check.py000066400000000000000000000033061447403454200172330ustar00rootroot00000000000000from click.testing import CliRunner from sigma.cli.check import check def test_check_help(): cli = CliRunner() result = cli.invoke(check, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 20 def test_check_valid(): cli = CliRunner() result = cli.invoke(check, ["tests/files/valid"]) assert result.exit_code == 0 assert "0 errors" in result.stdout assert "0 condition errors" in result.stdout assert "0 issues" in result.stdout def test_check_stdin(): cli = CliRunner() input = open("tests/files/valid/sigma_rule.yml", "rt").read() result = cli.invoke(check, ["-"], input=input) assert result.exit_code == 0 assert "0 errors" in result.stdout assert "0 condition errors" in result.stdout assert "0 issues" in result.stdout def test_check_invalid(): cli = CliRunner() result = cli.invoke(check, ["tests/files/invalid"]) assert result.exit_code == 1 assert "6 errors" in result.stdout assert "1 condition errors" in result.stdout assert "0 issues" in result.stdout def test_check_with_issues(): cli = CliRunner() result = cli.invoke(check, ["tests/files/issues"]) assert result.exit_code == 0 assert "3 issues" in result.stdout def test_check_with_issues_exclusions(): cli = CliRunner() result = cli.invoke(check, ["--validation-config", "tests/files/validation_config.yml", "tests/files/issues"]) assert result.exit_code == 0 assert "1 issues" in result.stdout def test_check_fail_on_issues(): cli = CliRunner() result = cli.invoke(check, ["--fail-on-issues", "tests/files/issues"]) assert result.exit_code == 1 assert "Validation issue summary" in result.stdoutsigma-cli-0.7.7/tests/test_convert.py000066400000000000000000000132201447403454200176320ustar00rootroot00000000000000from click.testing import CliRunner import pytest from sigma.cli.convert import convert import sigma.backends.test def test_convert_help(): cli = CliRunner() result = cli.invoke(convert, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 20 def test_convert_output_list_of_str(): cli = CliRunner() result = cli.invoke(convert, ["-t", "text_query_test", "-p", "another_test", "--disable-pipeline-check", "tests/files/valid"]) assert 'EventID=1 and ParentImage endswith "\\httpd.exe" and Image endswith "\\cmd.exe"' in result.stdout def test_convert_stdin(): cli = CliRunner() input = open("tests/files/valid/sigma_rule.yml", "rt").read() result = cli.invoke(convert, ["-t", "text_query_test", "-p", "another_test", "--disable-pipeline-check", "-"], input=input) assert 'EventID=1 and ParentImage endswith "\\httpd.exe" and Image endswith "\\cmd.exe"' in result.stdout def test_convert_output_list_of_dict(): cli = CliRunner() result = cli.invoke(convert, ["-t", "text_query_test", "-f", "list_of_dict", "tests/files/valid"]) assert 'ParentImage' in result.stdout def test_convert_output_list_of_dict_indent(): cli = CliRunner() result_noindent = cli.invoke(convert, ["-t", "text_query_test", "-f", "list_of_dict", "tests/files/valid"]) result_indent = cli.invoke(convert, ["-t", "text_query_test", "-f", "list_of_dict", "-j", "2", "tests/files/valid"]) assert len(result_indent.stdout.split("\n")) > len(result_noindent.stdout.split("\n")) def test_convert_output_str(): cli = CliRunner() result = cli.invoke(convert, ["-t", "text_query_test", "-f", "str", "tests/files/valid"]) assert 'ParentImage' in result.stdout # The following test is hard to implement: in a terminal it behaves as expected, as test it seems to be # something different. The outcome if this fails is also non-fatal: the user gets some binary output on a tty. # Therefore, the test is not implemented for now. """ def test_convert_output_bytes_without_output(monkeypatch): monkeypatch.setattr("click._io.IOBase", "isatty", lambda self: True) cli = CliRunner() result = cli.invoke(convert, ["-t", "qradar", "-f", "extension", "tests/files/valid"]) assert "provide output file" in result.stdout """ def test_convert_output_bytes(tmp_path): cli = CliRunner() test_file = tmp_path / "test.bin" result = cli.invoke(convert, ["-t", "text_query_test", "-f", "bytes", "-o", str(test_file), "tests/files/valid"]) assert result.exit_code == 0 assert "ParentImage" in open(test_file, "r").read() def test_convert_unknown_backend(): cli = CliRunner() result = cli.invoke(convert, ["-t", "notexisting", "-f", "foo", "tests/files/valid"]) assert "Invalid value for" in result.stdout assert "--plugin-type backend" in result.stdout def test_convert_unknown_format(): cli = CliRunner() result = cli.invoke(convert, ["-t", "text_query_test", "-f", "nonexisting", "tests/files/valid"]) assert "Invalid value for format" in result.stdout assert "sigma list formats" in result.stdout def test_convert_unknown_pipeline(): cli = CliRunner() result = cli.invoke(convert, ["-t", "text_query_test", "-p", "nonexisting", "tests/files/valid"]) assert "'nonexisting' was not found" in result.stdout assert "--plugin-type pipeline" in result.stdout def test_convert_missing_input(): cli = CliRunner() result = cli.invoke(convert, ["-t", "text_query_test"]) assert 'Missing argument' in result.stdout def test_convert_missing_pipeline(): cli = CliRunner() result = cli.invoke(convert, ["-t", "mandatory_pipeline_test", "tests/files/valid"]) assert result.exit_code > 0 and "pipeline required" in result.stdout def test_convert_missing_pipeline_ignore(): cli = CliRunner() result = cli.invoke(convert, ["-t", "mandatory_pipeline_test", "--without-pipeline", "tests/files/valid"]) assert 'ParentImage' in result.stdout def test_convert_wrong_pipeline(): cli = CliRunner() result = cli.invoke(convert, ["-t", "text_query_test", "-p", "another_test", "tests/files/valid"]) assert result.exit_code > 0 and "'another_test' is not intended" in result.stdout def test_yml_pipeline_doesnt_trigger_wrong_pipeline(): cli = CliRunner() result = cli.invoke(convert, ["-t", "text_query_test", "-p", "dummy_test", "-p", "tests/files/custom_pipeline.yml", "tests/files/valid"]) assert "some_other_string" in result.stdout def test_backend_option_invalid_format(): cli = CliRunner() result = cli.invoke(convert, ["-t", "text_query_test", "-O", "invalid", "tests/files/valid"]) assert result.exit_code != 0 assert "not format key=value" in result.stdout def test_backend_option_invalid_type(): cli = CliRunner() result = cli.invoke(convert, ["-t", "text_query_test", "-O", 123, "tests/files/valid"]) assert result.exit_code != 0 assert "must be a string" in result.stdout def test_backend_option_unknown_by_backend(): cli = CliRunner() result = cli.invoke(convert, ["-t", "text_query_test", "-O", "unknown=parameter", "tests/files/valid"]) assert result.exit_code != 0 assert "Parameter 'unknown' is not supported" in result.stdout def test_convert_output_backend_option(): cli = CliRunner() result = cli.invoke(convert, ["-t", "text_query_test", "-f", "list_of_dict", "-O", "testparam=testvalue", "tests/files/valid"]) assert 'testvalue' in result.stdout def test_convert_output_backend_option_list(): cli = CliRunner() result = cli.invoke(convert, ["-t", "text_query_test", "-f", "list_of_dict", "-O", "testparam=123", "-O", "testparam=test", "tests/files/valid"]) assert '[123, "test"]' in result.stdoutsigma-cli-0.7.7/tests/test_lists.py000066400000000000000000000064271447403454200173230ustar00rootroot00000000000000from typing import Counter import pytest from click.testing import CliRunner from sigma.cli.list import list_group, list_pipelines, list_targets, list_formats, list_validators, list_modifiers, list_transformations, list_conditions from sigma.plugins import InstalledSigmaPlugins from sigma.modifiers import modifier_mapping from sigma.processing.transformations import transformations from sigma.processing.conditions import rule_conditions, detection_item_conditions, field_name_conditions def test_list_help(): cli = CliRunner() result = cli.invoke(list_group, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 20 def test_list_pipelines_help(): cli = CliRunner() result = cli.invoke(list_pipelines, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 5 def test_list_targets_help(): cli = CliRunner() result = cli.invoke(list_targets, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 5 def test_list_formats_help(): cli = CliRunner() result = cli.invoke(list_formats, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 5 def test_list_validators_help(): cli = CliRunner() result = cli.invoke(list_validators, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 5 @pytest.fixture(params=[list_targets, list_pipelines], ids=["targets", "pipelines"]) def cli_list(request): cli = CliRunner() yield cli.invoke(request.param) def test_simple_list(cli_list): counts = Counter(cli_list.output) assert cli_list.exit_code == 0 \ and len(cli_list.output.split()) >= 5 \ and counts["|"] >= 6 \ and counts["-"] >= 40 def test_format_list(): cli = CliRunner() cli_list = cli.invoke(list_formats, ["text_query_test"]) counts = Counter(cli_list.output) assert cli_list.exit_code == 0 \ and len(cli_list.output.split()) >= 5 \ and counts["|"] >= 6 \ and counts["-"] >= 40 def test_pipeline_list_with_backend(): cli = CliRunner() list_all = cli.invoke(list_pipelines).stdout.split("\n") list_filtered = cli.invoke(list_pipelines, ["test"]).stdout.split("\n") assert len(list_all) > len(list_filtered) def test_validator_list(): cli = CliRunner() plugins = InstalledSigmaPlugins.autodiscover() validators = plugins.validators result = cli.invoke(list_validators) assert len(result.stdout.split()) > 10 assert all(( validator_name in result.stdout for validator_name in validators.keys() )) def test_modifier_list(): cli = CliRunner() result = cli.invoke(list_modifiers) assert all(( name in result.stdout for name in modifier_mapping.keys() )) def test_transformation_list(): cli = CliRunner() result = cli.invoke(list_transformations) assert all(( name in result.stdout for name in transformations.keys() )) def test_condition_list(): cli = CliRunner() result = cli.invoke(list_conditions) conditions = list(rule_conditions.keys()) conditions.extend(detection_item_conditions.keys()) conditions.extend(field_name_conditions.keys()) assert all(( name in result.stdout for name in conditions )) sigma-cli-0.7.7/tests/test_main.py000066400000000000000000000006421447403454200171020ustar00rootroot00000000000000from sigma.cli.main import cli as main, version from click.testing import CliRunner import re def test_help(): cli = CliRunner() result = cli.invoke(main, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 10 def test_version(): cli = CliRunner() result = cli.invoke(version) assert result.exit_code == 0 assert re.search("\\d+\\.\\d+\\.\\d+", result.stdout)sigma-cli-0.7.7/tests/test_plugin.py000066400000000000000000000043571447403454200174630ustar00rootroot00000000000000from click.testing import CliRunner from sigma.cli.plugin import plugin_group, list_plugins, install_plugin, uninstall_plugin def test_plugin_help(): cli = CliRunner() result = cli.invoke(plugin_group, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 20 def test_plugin_list_help(): cli = CliRunner() result = cli.invoke(list_plugins, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 20 def test_plugin_install_help(): cli = CliRunner() result = cli.invoke(install_plugin, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 20 def test_plugin_uninstall_help(): cli = CliRunner() result = cli.invoke(uninstall_plugin, ["--help"]) assert result.exit_code == 0 assert len(result.stdout.split()) > 20 def test_plugin_list(): cli = CliRunner() plugin_list = cli.invoke(list_plugins) assert plugin_list.exit_code == 0 assert len(plugin_list.output.split()) > 10 def test_plugin_list_filtered(): cli = CliRunner() plugin_list = cli.invoke(list_plugins) plugin_list_filtered = cli.invoke(list_plugins, [ "-t", "backend", "-s", "stable"]) assert plugin_list.exit_code == 0 assert plugin_list_filtered.exit_code == 0 assert len(plugin_list.output.split()) > len(plugin_list_filtered.output.split()) def test_plugin_list_search(): cli = CliRunner() plugin_list = cli.invoke(list_plugins) plugin_list_search = cli.invoke(list_plugins, [ "Sysmon" ]) assert plugin_list.exit_code == 0 assert plugin_list_search.exit_code == 0 assert len(plugin_list.output.split()) > len(plugin_list_search.output.split()) def test_plugin_install_notexisting(): cli = CliRunner() result = cli.invoke(install_plugin, ["notexisting"]) assert result.exit_code != 0 assert "error" in result.output.lower() def test_plugin_install(): cli = CliRunner() result = cli.invoke(install_plugin, ["splunk"]) assert result.exit_code == 0 assert "Successfully installed" in result.output def test_plugin_uninstall(): cli = CliRunner() result = cli.invoke(uninstall_plugin, ["splunk"]) assert result.exit_code == 0 assert "Successfully uninstalled" in result.output