rsigma 0.24.0

CLI for parsing, validating, linting and evaluating Sigma detection rules
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

//! Integration tests for `rsigma rule reverse`.

mod common;

use common::rsigma;

#[test]
fn reverse_requires_a_logsource() {
    for extra in [None, Some("--logsource-product")] {
        let mut cmd = rsigma();
        cmd.args(["rule", "reverse", "--from", "lucene", "EventID:1"]);
        if let Some(flag) = extra {
            cmd.args([flag, ""]);
        }
        let out = cmd.output().unwrap();
        assert_eq!(out.status.code(), Some(3));
        let stderr = String::from_utf8_lossy(&out.stderr);
        assert!(
            stderr.contains("needs a logsource; pass --logsource-product"),
            "{stderr}"
        );
    }
}

#[test]
fn reverse_emits_the_given_logsource() {
    let out = rsigma()
        .args([
            "rule",
            "reverse",
            "--from",
            "lucene",
            "EventID:1",
            "--logsource-category",
            "process_creation",
        ])
        .output()
        .unwrap();
    assert!(
        out.status.success(),
        "{}",
        String::from_utf8_lossy(&out.stderr)
    );
    let stdout = String::from_utf8_lossy(&out.stdout);
    assert!(
        stdout.contains("logsource:\n    category: process_creation"),
        "{stdout}"
    );
}