def handler(q=False): if q is False: return False request = json.loads(q) if not request.get('sigma'): misperrors['error'] = 'Sigma rule missing' return misperrors config = SigmaConfiguration() f = io.TextIOWrapper(io.BytesIO(request.get('sigma').encode()), encoding='utf-8') parser = SigmaCollectionParser(f, config) targets = [] results = [] for t in sigma_targets: backend = getBackend(t)(config, {'rulecomment': False}) try: parser.generate(backend) result = backend.finalize() if result: results.append(result) targets.append(t) except Exception: continue d_result = {t: r.strip() for t, r in zip(targets, results)} return { 'results': [{ 'types': mispattributes['output'], 'values': d_result }] }
def handler(q=False): if q is False: return False request = json.loads(q) if not request.get('sigma'): misperrors['error'] = 'Sigma rule missing' return misperrors config = SigmaConfiguration() backend_options = BackendOptions(None) f = io.TextIOWrapper(io.BytesIO(request.get('sigma').encode()), encoding='utf-8') parser = SigmaCollectionParser(f, config, None) targets = [] old_stdout = sys.stdout result = io.StringIO() sys.stdout = result for t in sigma_targets: backend = getBackend(t)(config, backend_options, None) try: parser.generate(backend) backend.finalize() print("#NEXT") targets.append(t) except Exception: continue sys.stdout = old_stdout results = result.getvalue()[:-5].split('#NEXT') d_result = {t: r.strip() for t, r in zip(targets, results)} return { 'results': [{ 'types': mispattributes['output'], 'values': d_result }] }
def sigma_to_query(self, sigma_file: str): """convert a Sigma rule file to query using the backend/config properties""" # initialize config manager to retrieve config scm = SigmaConfigurationManager() sigmaconfigs = SigmaConfigurationChain() sigmaconfig = scm.get(self.config) sigmaconfigs.append(sigmaconfig) # dynamically grab backend and pair to config backend_class = backends.getBackend(self.backend) backend = backend_class(sigmaconfigs) with open(sigma_file) as f: parser = SigmaCollectionParser(f, sigmaconfigs) parser.generate(backend) return json.loads(backend.finalize())
def generateSqlQuery(self, sigma_io): try: # Check if sigma_io can be parsed parser = SigmaCollectionParser(sigma_io, self.config, None) except Exception as e: raise SigmaParseError("Parsing error: {}".format(e)) # generate sql query queries = list(parser.generate(self.SQL)) # extract parsed rules parsed_rules = [parser.parsedyaml for parser in parser.parsers] # returns the SQL-Query with the parsed rule return list(zip(queries, parsed_rules))
def main(): argparser = set_argparser() cmdargs = argparser.parse_args() scm = SigmaConfigurationManager() logger = logging.getLogger(__name__) if cmdargs.debug: # pragma: no cover logger.setLevel(logging.DEBUG) if cmdargs.lists: print("Backends (Targets):") list_backends(cmdargs.debug) print() print("Configurations (Sources):") list_configurations(backend=cmdargs.target, scm=scm) print() print("Modifiers:") list_modifiers(modifiers=modifiers) sys.exit(0) elif len(cmdargs.inputs) == 0: print("Nothing to do!") argparser.print_usage() sys.exit(0) if cmdargs.target is None: print("No target selected, select one with -t/--target") argparser.print_usage() sys.exit(ERR_NO_TARGET) rulefilter = None if cmdargs.filter: try: rulefilter = SigmaRuleFilter(cmdargs.filter) except SigmaRuleFilterParseException as e: print("Parse error in Sigma rule filter expression: %s" % str(e), file=sys.stderr) sys.exit(ERR_RULE_FILTER_PARSING) sigmaconfigs = SigmaConfigurationChain() backend_class = backends.getBackend(cmdargs.target) if cmdargs.config is None: if backend_class.config_required and not cmdargs.shoot_yourself_in_the_foot: print("The backend you want to use usually requires a configuration to generate valid results. Please provide one with --config/-c.", file=sys.stderr) print("Available choices for this backend (get complete list with --lists/-l):") list_configurations(backend=cmdargs.target, scm=scm) sys.exit(ERR_CONFIG_REQUIRED) if backend_class.default_config is not None: cmdargs.config = backend_class.default_config if cmdargs.config: order = 0 for conf_name in cmdargs.config: try: sigmaconfig = scm.get(conf_name) if sigmaconfig.order is not None: if sigmaconfig.order <= order and not cmdargs.shoot_yourself_in_the_foot: print("The configurations were provided in the wrong order (order key check in config file)", file=sys.stderr) sys.exit(ERR_CONFIG_ORDER) order = sigmaconfig.order try: if cmdargs.target not in sigmaconfig.config["backends"]: print("The configuration '{}' is not valid for backend '{}'. Valid choices are: {}".format(conf_name, cmdargs.target, ", ".join(sigmaconfig.config["backends"])), file=sys.stderr) sys.exit(ERR_CONFIG_ORDER) except KeyError: pass sigmaconfigs.append(sigmaconfig) except OSError as e: print("Failed to open Sigma configuration file %s: %s" % (conf_name, str(e)), file=sys.stderr) exit(ERR_OPEN_CONFIG_FILE) except (yaml.parser.ParserError, yaml.scanner.ScannerError) as e: print("Sigma configuration file %s is no valid YAML: %s" % (conf_name, str(e)), file=sys.stderr) exit(ERR_CONFIG_INVALID_YAML) except SigmaConfigParseError as e: print("Sigma configuration parse error in %s: %s" % (conf_name, str(e)), file=sys.stderr) exit(ERR_CONFIG_PARSING) backend_options = BackendOptions(cmdargs.backend_option, cmdargs.backend_config) backend = backend_class(sigmaconfigs, backend_options) filename = cmdargs.output if filename: try: out = open(filename, "w", encoding='utf-8') except (IOError, OSError) as e: print("Failed to open output file '%s': %s" % (filename, str(e)), file=sys.stderr) exit(ERR_OUTPUT) else: out = sys.stdout error = 0 for sigmafile in get_inputs(cmdargs.inputs, cmdargs.recurse): logger.debug("* Processing Sigma input %s" % (sigmafile)) try: if cmdargs.inputs == ['-']: f = sigmafile else: f = sigmafile.open(encoding='utf-8') parser = SigmaCollectionParser(f, sigmaconfigs, rulefilter) results = parser.generate(backend) for result in results: print(result, file=out) except OSError as e: print("Failed to open Sigma file %s: %s" % (sigmafile, str(e)), file=sys.stderr) error = ERR_OPEN_SIGMA_RULE except (yaml.parser.ParserError, yaml.scanner.ScannerError) as e: print("Sigma file %s is no valid YAML: %s" % (sigmafile, str(e)), file=sys.stderr) error = ERR_INVALID_YAML if not cmdargs.defer_abort: sys.exit(error) except (SigmaParseError, SigmaCollectionParseError) as e: print("Sigma parse error in %s: %s" % (sigmafile, str(e)), file=sys.stderr) error = ERR_SIGMA_PARSING if not cmdargs.defer_abort: sys.exit(error) except NotSupportedError as e: print("The Sigma rule requires a feature that is not supported by the target system: " + str(e), file=sys.stderr) if not cmdargs.ignore_backend_errors: error = ERR_NOT_SUPPORTED if not cmdargs.defer_abort: sys.exit(error) except BackendError as e: print("Backend error in %s: %s" % (sigmafile, str(e)), file=sys.stderr) if not cmdargs.ignore_backend_errors: error = ERR_BACKEND if not cmdargs.defer_abort: sys.exit(error) except (NotImplementedError, TypeError) as e: print("An unsupported feature is required for this Sigma rule (%s): " % (sigmafile) + str(e), file=sys.stderr) print("Feel free to contribute for fun and fame, this is open source :) -> https://github.com/Neo23x0/sigma", file=sys.stderr) if not cmdargs.ignore_backend_errors: error = ERR_NOT_IMPLEMENTED if not cmdargs.defer_abort: sys.exit(error) except PartialMatchError as e: print("Partial field match error: %s" % str(e), file=sys.stderr) if not cmdargs.ignore_backend_errors: error = ERR_PARTIAL_FIELD_MATCH if not cmdargs.defer_abort: sys.exit(error) except FullMatchError as e: print("Full field match error", file=sys.stderr) if not cmdargs.ignore_backend_errors: error = ERR_FULL_FIELD_MATCH if not cmdargs.defer_abort: sys.exit(error) finally: try: f.close() except: pass result = backend.finalize() if result: print(result, file=out) out.close() sys.exit(error)
def run(constants): output_dir = constants.get('output_dir', DEFAULT_OUTPUT_DIR) rules_dir = constants.get('rules_dir', DEFAULT_RULES_DIR) backend = constants.get('backend', DEFAULT_BACKEND) filename = output_dir / 'query' try: out = open(filename, 'w', encoding='utf-8') except (IOError, OSError) as e: print('Failed to open output file "%s": %s' % (str(filename), str(e)), file=sys.stderr) sys.exit(1) error = 0 inputs = get_inputs(rules_dir) for path in inputs: logger.debug('Processing Sigma rule "%s"' % path) f = None # noinspection PyUnresolvedReferences try: f = path.open(encoding='utf-8') sigma_parser = SigmaCollectionParser(f) results = sigma_parser.generate(backend) for result in results: print(result, file=out) except OSError as e: print('Failed to open Sigma rule file "%s": %s' % (path, str(e)), file=sys.stderr) error = 5 except (yaml.parser.ParseError, yaml.scanner.ScannerError) as e: print('Sigma rule file "%s" is invalid YAML: %s' % (path, str(e)), file=sys.stderr) error = 3 sys.exit(error) except (SigmaParseError, SigmaCollectionParseError) as e: print('Sigma parse error in "%s": %s' % (path, str(e)), file=sys.stderr) error = 4 sys.exit(error) except NotSupportedError as e: print('The Sigma rule requires a feature that is not supported by the target system:', str(e), file=sys.stderr) error = 9 sys.exit(error) except BackendError as e: print('Backend error in "%s": %s' % (path, str(e)), file=sys.stderr) error = 8 sys.exit(error) except NotImplementedError as e: print('An unsupported feature is required for this Sigma rule "%s": %s' % (path, str(e)), file=sys.stderr) error = 42 sys.exit(error) except PartialMatchError as e: print('Partial field match error:', str(e), file=sys.stderr) error = 80 sys.exit(error) except FullMatchError as e: print('Full field match error:', str(e), file=sys.stderr) error = 90 sys.exit(error) finally: # noinspection PyBroadException try: f.close() except Exception: pass result = backend.finalize() if result: print(result, file=out) out.close() sys.exit(error)
def main(): argparser = set_argparser() cmdargs = argparser.parse_args() scm = SigmaConfigurationManager() logger = logging.getLogger(__name__) if cmdargs.debug: # pragma: no cover logging.basicConfig(filename='sigmac.log', filemode='w', level=logging.DEBUG) logger.setLevel(logging.DEBUG) if cmdargs.lists: print("Backends (Targets):") list_backends(cmdargs.debug) print() print("Configurations (Sources):") list_configurations(backend=cmdargs.target, scm=scm) print() print("Modifiers:") list_modifiers(modifiers=modifiers) sys.exit(0) elif len(cmdargs.inputs) == 0: print("Nothing to do!") argparser.print_usage() sys.exit(0) if cmdargs.target is None: print("No target selected, select one with -t/--target") argparser.print_usage() sys.exit(ERR_NO_TARGET) logger.debug("* Target selected %s" % (cmdargs.target)) rulefilter = None if cmdargs.filter: try: rulefilter = SigmaRuleFilter(cmdargs.filter) except SigmaRuleFilterParseException as e: print("Parse error in Sigma rule filter expression: %s" % str(e), file=sys.stderr) sys.exit(ERR_RULE_FILTER_PARSING) sigmaconfigs = SigmaConfigurationChain() backend_class = backends.getBackend(cmdargs.target) if cmdargs.config is None: if backend_class.config_required and not cmdargs.shoot_yourself_in_the_foot: print( "The backend you want to use usually requires a configuration to generate valid results. Please provide one with --config/-c.", file=sys.stderr) print( "Available choices for this backend (get complete list with --lists/-l):" ) list_configurations(backend=cmdargs.target, scm=scm) sys.exit(ERR_CONFIG_REQUIRED) if backend_class.default_config is not None: cmdargs.config = backend_class.default_config if cmdargs.config: order = 0 for conf_name in cmdargs.config: try: sigmaconfig = scm.get(conf_name) if sigmaconfig.order is not None: if sigmaconfig.order <= order and not cmdargs.shoot_yourself_in_the_foot: print( "The configurations were provided in the wrong order (order key check in config file)", file=sys.stderr) sys.exit(ERR_CONFIG_ORDER) order = sigmaconfig.order try: if cmdargs.target not in sigmaconfig.config["backends"]: print( "The configuration '{}' is not valid for backend '{}'. Valid choices are: {}" .format(conf_name, cmdargs.target, ", ".join(sigmaconfig.config["backends"])), file=sys.stderr) sys.exit(ERR_CONFIG_ORDER) except KeyError: pass sigmaconfigs.append(sigmaconfig) except OSError as e: print("Failed to open Sigma configuration file %s: %s" % (conf_name, str(e)), file=sys.stderr) exit(ERR_OPEN_CONFIG_FILE) except (yaml.parser.ParserError, yaml.scanner.ScannerError) as e: print("Sigma configuration file %s is no valid YAML: %s" % (conf_name, str(e)), file=sys.stderr) exit(ERR_CONFIG_INVALID_YAML) except SigmaConfigParseError as e: print("Sigma configuration parse error in %s: %s" % (conf_name, str(e)), file=sys.stderr) exit(ERR_CONFIG_PARSING) if cmdargs.output_fields: if cmdargs.output_format: output_fields_rejected = [ field for field in cmdargs.output_fields.split(",") if field not in allowed_fields ] # Not allowed fields if output_fields_rejected: print( "These fields are not allowed (check help for allow field list) : %s" % (", ".join(output_fields_rejected)), file=sys.stderr) exit(ERR_OUTPUT_FORMAT) else: output_fields_filtered = [ field for field in cmdargs.output_fields.split(",") if field in allowed_fields ] # Keep only allowed fields else: print( "The '--output-fields' or '-of' arguments must be used with '--output-format' or '-oF' equal to 'json' or 'yaml'", file=sys.stderr) exit(ERR_OUTPUT_FORMAT) backend_options = BackendOptions(cmdargs.backend_option, cmdargs.backend_config) backend = backend_class(sigmaconfigs, backend_options) filename_ext = cmdargs.output_extention filename = cmdargs.output fileprefix = None if filename: if filename_ext: if filename_ext[0] == '.': pass else: filename_ext = '.' + filename_ext else: filename_ext = '.rule' if filename[-1:] in ['_', '/', '\\']: fileprefix = filename else: try: out = open(filename, "w", encoding='utf-8') except (IOError, OSError) as e: print("Failed to open output file '%s': %s" % (filename, str(e)), file=sys.stderr) exit(ERR_OUTPUT) else: out = sys.stdout error = 0 output_array = [] for sigmafile in get_inputs(cmdargs.inputs, cmdargs.recurse): logger.debug("* Processing Sigma input %s" % (sigmafile)) success = True try: if cmdargs.inputs == ['-']: f = sigmafile else: f = sigmafile.open(encoding='utf-8') parser = SigmaCollectionParser(f, sigmaconfigs, rulefilter, sigmafile) results = parser.generate(backend) nb_result = len(list(copy.deepcopy(results))) inc_filenane = None if nb_result < 2 else 0 newline_separator = '\0' if cmdargs.print0 else '\n' results = list( results ) # Since results is an iterator and used twice we convert it a list for result in results: if not fileprefix == None and not inc_filenane == None: #yml action try: filename = fileprefix + str(sigmafile.name) filename = filename.replace( '.yml', '_' + str(inc_filenane) + filename_ext) inc_filenane += 1 out = open(filename, "w", encoding='utf-8') except (IOError, OSError) as e: print("Failed to open output file '%s': %s" % (filename, str(e)), file=sys.stderr) exit(ERR_OUTPUT) elif not fileprefix == None and inc_filenane == None: # a simple yml try: filename = fileprefix + str(sigmafile.name) filename = filename.replace('.yml', filename_ext) out = open(filename, "w", encoding='utf-8') except (IOError, OSError) as e: print("Failed to open output file '%s': %s" % (filename, str(e)), file=sys.stderr) exit(ERR_OUTPUT) if not cmdargs.output_fields: print(result, file=out, end=newline_separator) if cmdargs.output_fields: # Handle output fields output = {} f.seek(0) docs = yaml.load_all(f, Loader=yaml.FullLoader) for doc in docs: for k, v in doc.items(): if k in output_fields_filtered: output[k] = v output['rule'] = [result for result in results] if "filename" in output_fields_filtered: output['filename'] = str(sigmafile.name) output_array.append(output) if nb_result == 0: # backend get only 1 output if not fileprefix == None: # want a prefix anyway try: filename = "%s%s_mono_output%s" % ( fileprefix, cmdargs.target, filename_ext) out = open(filename, "w", encoding='utf-8') fileprefix = None # no need to open the same file many time except (IOError, OSError) as e: print("Failed to open output file '%s': %s" % (filename, str(e)), file=sys.stderr) exit(ERR_OUTPUT) except OSError as e: print("Failed to open Sigma file %s: %s" % (sigmafile, str(e)), file=sys.stderr) logger.debug("* Convertion Sigma input %s FAILURE" % (sigmafile)) success = False error = ERR_OPEN_SIGMA_RULE except (yaml.parser.ParserError, yaml.scanner.ScannerError) as e: print("Error: Sigma file %s is no valid YAML: %s" % (sigmafile, str(e)), file=sys.stderr) logger.debug("* Convertion Sigma input %s FAILURE" % (sigmafile)) success = False error = ERR_INVALID_YAML if not cmdargs.defer_abort: sys.exit(error) except (SigmaParseError, SigmaCollectionParseError) as e: print("Error: Sigma parse error in %s: %s" % (sigmafile, str(e)), file=sys.stderr) logger.debug("* Convertion Sigma input %s FAILURE" % (sigmafile)) success = False error = ERR_SIGMA_PARSING if not cmdargs.defer_abort: sys.exit(error) except NotSupportedError as e: print( "Error: The Sigma rule requires a feature that is not supported by the target system: " + str(e), file=sys.stderr) logger.debug("* Convertion Sigma input %s FAILURE" % (sigmafile)) success = False if not cmdargs.ignore_backend_errors: error = ERR_NOT_SUPPORTED if not cmdargs.defer_abort: sys.exit(error) except BackendError as e: print("Error: Backend error in %s: %s" % (sigmafile, str(e)), file=sys.stderr) logger.debug("* Convertion Sigma input %s FAILURE" % (sigmafile)) success = False if not cmdargs.ignore_backend_errors: error = ERR_BACKEND if not cmdargs.defer_abort: sys.exit(error) except (NotImplementedError, TypeError) as e: print( "An unsupported feature is required for this Sigma rule (%s): " % (sigmafile) + str(e), file=sys.stderr) logger.debug("* Convertion Sigma input %s FAILURE" % (sigmafile)) success = False if not cmdargs.ignore_backend_errors: error = ERR_NOT_IMPLEMENTED if not cmdargs.defer_abort: sys.exit(error) except PartialMatchError as e: print("Error: Partial field match error: %s" % str(e), file=sys.stderr) logger.debug("* Convertion Sigma input %s FAILURE" % (sigmafile)) success = False if not cmdargs.ignore_backend_errors: error = ERR_PARTIAL_FIELD_MATCH if not cmdargs.defer_abort: sys.exit(error) except FullMatchError as e: print("Error: Full field match error", file=sys.stderr) logger.debug("* Convertion Sigma input %s FAILURE" % (sigmafile)) success = False if not cmdargs.ignore_backend_errors: error = ERR_FULL_FIELD_MATCH if not cmdargs.defer_abort: sys.exit(error) finally: try: f.close() except: pass if success: logger.debug("* Convertion Sigma input %s SUCCESS" % (sigmafile)) result = backend.finalize() if result: print(result, file=out) if cmdargs.output_fields: if cmdargs.output_format == 'json': print(json.dumps(output_array, indent=4, ensure_ascii=False), file=out) elif cmdargs.output_format == 'yaml': print(ruamel.yaml.round_trip_dump(output_array), file=out) out.close() sys.exit(error)