rsigma 0.22.0

CLI for parsing, validating, linting and evaluating Sigma detection rules
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127

//! Integration tests for the `engine discover-schemas` subcommand.

mod common;

use common::{rsigma, temp_file};
use predicates::prelude::*;

const MIXED_CORPUS: &str = concat!(
    r#"{"vendor":"acme","event_type":"alert","severity":5}"#,
    "\n",
    r#"{"vendor":"acme","event_type":"alert","severity":3}"#,
    "\n",
    r#"{"vendor":"acme","event_type":"alert","severity":8}"#,
    "\n",
    r#"{"vendor":"acme","event_type":"alert","severity":2}"#,
    "\n",
    // An ECS event: recognized by a built-in, so it must never be mined.
    r#"{"ecs.version":"8.11.0","process":{"command_line":"whoami"}}"#,
    "\n",
);

#[test]
fn discovers_candidate_from_ndjson_stdin() {
    rsigma()
        .args(["engine", "discover-schemas", "--output-format", "json"])
        .write_stdin(MIXED_CORPUS)
        .assert()
        .success()
        // The four vendor events are mined; the ECS event is excluded.
        .stdout(predicate::str::contains("\"events_mined\": 4"))
        .stdout(predicate::str::contains("\"discovered_alert\""))
        .stdout(predicate::str::contains("\"signatures_yaml\""));
}

#[test]
fn emit_yaml_prints_only_the_schemas_block() {
    let out = rsigma()
        .args(["engine", "discover-schemas", "--emit", "yaml"])
        .write_stdin(MIXED_CORPUS)
        .output()
        .expect("run discover");
    assert!(out.status.success());
    let yaml = String::from_utf8(out.stdout).expect("utf8");
    assert!(yaml.trim_start().starts_with("schemas:"), "got: {yaml}");
    assert!(yaml.contains("event_type"));
    // The report chrome must be absent in yaml-only mode.
    assert!(!yaml.contains("SUPPORT"));
    assert!(!yaml.contains("Paste into"));
}

#[test]
fn dry_run_reports_before_and_after_counts() {
    rsigma()
        .args([
            "engine",
            "discover-schemas",
            "--dry-run",
            "--output-format",
            "table",
        ])
        .write_stdin(MIXED_CORPUS)
        .assert()
        .success()
        .stdout(predicate::str::contains("Dry run (classification impact)"))
        // Before mining everything is generic_json; the proposals drain it.
        .stdout(predicate::str::contains("generic_json: 4 -> 0"));
}

#[test]
fn emitted_yaml_round_trips_through_classify() {
    // Discover proposals, then feed them back to `engine classify` and confirm
    // the previously-unknown events now classify under a discovered schema.
    let out = rsigma()
        .args(["engine", "discover-schemas", "--emit", "yaml"])
        .write_stdin(MIXED_CORPUS)
        .output()
        .expect("run discover");
    assert!(out.status.success());
    let yaml = String::from_utf8(out.stdout).expect("utf8");
    let config = temp_file(".yml", &yaml);

    rsigma()
        .args([
            "engine",
            "classify",
            "-e",
            r#"{"vendor":"acme","event_type":"alert","severity":9}"#,
            "--schema-config",
            config.path().to_str().unwrap(),
            "--output-format",
            "json",
        ])
        .assert()
        .success()
        .stdout(predicate::str::contains("\"schema\": \"discovered_alert\""));
}

#[test]
fn no_value_markers_yields_presence_predicates() {
    let out = rsigma()
        .args([
            "engine",
            "discover-schemas",
            "--emit",
            "yaml",
            "--no-value-markers",
        ])
        .write_stdin(MIXED_CORPUS)
        .output()
        .expect("run discover");
    assert!(out.status.success());
    let yaml = String::from_utf8(out.stdout).expect("utf8");
    assert!(yaml.contains("field_present:"), "got: {yaml}");
    assert!(
        !yaml.contains("equals:"),
        "value markers should be off: {yaml}"
    );
}

#[test]
fn evtx_path_is_rejected() {
    rsigma()
        .args(["engine", "discover-schemas", "-e", "@evidence.evtx"])
        .assert()
        .failure()
        .stderr(predicate::str::contains(".evtx"));
}