santh-sigma 0.1.4

Sigma rule compiler for security research
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

//! Performance tests for the sigma compiler
//!
//! Each test has a time bound that must not be exceeded.

use sigma::SigmaCompiler;
use std::time::Instant;

/// 16. Sigma compilation of 50 rules in < 200ms
#[test]
fn sigma_compilation_50_rules_in_200ms() {
    let rules: Vec<String> = (0..50)
        .map(|i| {
            format!(
                r#"
title: Sigma Test Rule {}
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - "powershell.exe"
      - "cmd.exe"
      - "wscript.exe"
    ParentImage|endswith:
      - "\\winword.exe"
      - "\\excel.exe"
      - "\\outlook.exe"
  condition: selection
level: high
"#,
                i
            )
        })
        .collect();

    let start = Instant::now();
    for rule in &rules {
        let _template = SigmaCompiler::compile_str(rule).unwrap();
    }
    let elapsed = start.elapsed();

    assert!(
        elapsed.as_millis() < 200,
        "Compiling 50 Sigma rules took {:?}, expected < 200ms",
        elapsed
    );
}