santh-sigma 0.1.4

Sigma rule compiler for security research
Documentation
use sigma::SigmaCompiler;
use std::sync::{Arc, Barrier};
use std::thread;

#[test]
fn compile_concurrent_100_threads() {
    let yaml = r#"
title: Concurrent Compile Test
logsource:
  product: windows
detection:
  selection:
    CommandLine|contains: powershell.exe
  condition: selection
level: high
"#;

    let num_threads = 100;
    let barrier = Arc::new(Barrier::new(num_threads));
    let mut handles = vec![];

    let yaml_str = Arc::new(yaml.to_string());

    for _ in 0..num_threads {
        let b = Arc::clone(&barrier);
        let y = Arc::clone(&yaml_str);
        
        handles.push(thread::spawn(move || {
            b.wait();
            
            // Perform multiple compilations in each thread to stress memory
            for _ in 0..10 {
                let template = SigmaCompiler::compile_str(&y).expect("Should compile");
                assert_eq!(template.id, "concurrent-compile-test");
                assert_eq!(template.requests[0].matchers.len(), 1);
                assert_eq!(template.requests[0].matchers[0].values[0], "powershell.exe");
            }
        }));
    }

    for handle in handles {
        handle.join().expect("Thread panicked");
    }
}

#[test]
fn compile_concurrent_different_rules() {
    let num_threads = 50;
    let barrier = Arc::new(Barrier::new(num_threads));
    let mut handles = vec![];

    for i in 0..num_threads {
        let b = Arc::clone(&barrier);
        let yaml = format!(r#"
title: Concurrent Diff {}
logsource:
  product: windows
detection:
  selection:
    EventID: {}
  condition: selection
level: medium
"#, i, i);

        handles.push(thread::spawn(move || {
            b.wait();
            
            let template = SigmaCompiler::compile_str(&yaml).expect("Should compile");
            assert_eq!(template.id, format!("concurrent-diff-{}", i));
            assert_eq!(template.requests[0].matchers[0].values[0], format!("{}", i));
        }));
    }

    for handle in handles {
        handle.join().expect("Thread panicked");
    }
}