rsigma-parser 0.7.0

Parser for Sigma detection rules, correlations, and filters
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139

use rsigma_parser::{SigmaParserError, parse_condition, parse_field_spec, parse_sigma_yaml};

#[test]
fn field_spec_empty_field_name_with_modifier() {
    // "|contains" -- empty field name, valid modifier. Should parse to None field name.
    let spec = parse_field_spec("|contains").unwrap();
    assert!(spec.name.is_none());
    assert_eq!(spec.modifiers.len(), 1);
}

#[test]
fn field_spec_double_pipe_produces_unknown_modifier() {
    // "field||contains" -- splits to ["field", "", "contains"]; empty string is unknown modifier.
    let err = parse_field_spec("field||contains").unwrap_err();
    assert!(
        matches!(err, SigmaParserError::UnknownModifier(ref s) if s.is_empty()),
        "expected UnknownModifier for empty modifier string, got: {err}"
    );
}

#[test]
fn field_spec_trailing_pipe_produces_unknown_modifier() {
    // "field|" -- splits to ["field", ""]; empty string is unknown modifier.
    let err = parse_field_spec("field|").unwrap_err();
    assert!(
        matches!(err, SigmaParserError::UnknownModifier(ref s) if s.is_empty()),
        "expected UnknownModifier for trailing pipe, got: {err}"
    );
}

#[test]
fn condition_trailing_operator_fails_with_location() {
    // "selection and" -- dangling operator at end, should fail with location info.
    let err = parse_condition("selection and").unwrap_err();
    assert!(
        matches!(err, SigmaParserError::Condition(_, _)),
        "expected Condition error, got: {err}"
    );
}

#[test]
fn condition_unmatched_parens_fails() {
    let err = parse_condition("(selection and filter").unwrap_err();
    assert!(
        matches!(err, SigmaParserError::Condition(_, _)),
        "expected Condition error for unmatched paren, got: {err}"
    );
}

#[test]
fn condition_double_operator_fails() {
    let err = parse_condition("selection and or filter").unwrap_err();
    assert!(
        matches!(err, SigmaParserError::Condition(_, _)),
        "expected Condition error for 'and or', got: {err}"
    );
}

#[test]
fn multi_doc_mixed_valid_and_invalid_collects_both() {
    // First doc is a valid rule, second doc is malformed (missing title).
    // The collection should contain the valid rule AND report the error.
    let yaml = r#"
title: Valid Rule
logsource:
    product: windows
detection:
    selection:
        CommandLine|contains: test
    condition: selection
level: low
---
logsource:
    product: windows
detection:
    selection:
        CommandLine|contains: test
    condition: selection
level: low
"#;
    let collection = parse_sigma_yaml(yaml).unwrap();
    assert_eq!(
        collection.rules.len(),
        1,
        "first valid rule should be collected"
    );
    assert!(
        !collection.errors.is_empty(),
        "second doc's error should be reported"
    );
}

#[test]
fn correlation_missing_type_reports_clear_error() {
    let yaml = r#"
title: Bad Correlation
correlation:
    rules:
        - some-rule
    timespan: 60s
    condition:
        gte: 3
level: high
"#;
    let collection = parse_sigma_yaml(yaml).unwrap();
    assert!(
        !collection.errors.is_empty(),
        "missing correlation type should produce an error"
    );
    assert!(
        collection.errors[0].contains("type"),
        "error message should mention 'type', got: {}",
        collection.errors[0]
    );
}

#[test]
fn correlation_missing_timespan_reports_clear_error() {
    let yaml = r#"
title: Bad Correlation
correlation:
    type: event_count
    rules:
        - some-rule
    condition:
        gte: 3
level: high
"#;
    let collection = parse_sigma_yaml(yaml).unwrap();
    assert!(
        !collection.errors.is_empty(),
        "missing timespan should produce an error"
    );
    let err = &collection.errors[0];
    assert!(
        err.contains("timespan") || err.contains("timeframe"),
        "error should mention timespan/timeframe, got: {err}"
    );
}