Commitcd5360b

authored

Merge pull request#34 from UncoderIO/issue-33

Sigma Platform: The "references" field is now optional; fixed problem…

2 parents82a49e2 +d54f88f commitcd5360bCopy full SHA for cd5360b

File tree

-2

lines changed

-2

lines changed

Lines changed: 6 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -37,7 +37,7 @@ class SigmaParser(YamlRuleMixin):`
`37`	`37`	`condition_tokenizer=SigmaConditionTokenizer()`
`38`	`38`	`tokenizer:SigmaTokenizer=SigmaTokenizer()`
`39`	`39`	`mappings:SigmaMappings=sigma_mappings`
`40`		`-mandatory_fields= {"title","description","references","logsource","detection"}`
	`40`	`+mandatory_fields= {"title","description","logsource","detection"}`
`41`	`41`
`42`	`42`	`@staticmethod`
`43`	`43`	`def__parse_false_positives(false_positives:Union[str,List[str],None])->list:`
`@@ -69,7 +69,11 @@ def __validate_rule(self, rule: dict):`
`69`	`69`	`defparse(self,text:str)->SiemContainer:`
`70`	`70`	`sigma_rule=self.load_rule(text=text)`
`71`	`71`	`self.__validate_rule(rule=sigma_rule)`
`72`		`-log_sources= {key: [value]forkey,valuein (sigma_rule.get("logsource", {})).items()}`
	`72`	`+log_sources= {`
	`73`	`+key: [value]`
	`74`	`+forkey,valuein (sigma_rule.get("logsource", {})).items()`
	`75`	`+ifkeyin ("product","service","category")`
	`76`	`+ }`
`73`	`77`	`tokens=self.tokenizer.tokenize(detection=sigma_rule.get("detection"))`
`74`	`78`	`field_tokens=QueryTokenizer.filter_tokens(tokens,Field)`
`75`	`79`	`field_names= [field.source_nameforfieldinfield_tokens]`

Comments

(0)