rsigma_parser/
lib.rs

1//! # rsigma-parser
2//!
3//! A comprehensive parser for Sigma detection rules, correlations, and filters.
4//!
5//! This crate parses Sigma YAML files into a strongly-typed AST, handling:
6//!
7//! - **Detection rules**: field matching, wildcards, boolean conditions, field modifiers
8//! - **Condition expressions**: `and`, `or`, `not`, `1 of`, `all of`, parenthesized groups
9//! - **Correlation rules**: `event_count`, `value_count`, `temporal`, aggregations
10//! - **Filter rules**: additional conditions applied to referenced rules
11//! - **Rule collections**: multi-document YAML, `action: global/reset/repeat`
12//! - **Value types**: strings with wildcards, numbers, booleans, null, regex, CIDR
13//! - **All 30+ field modifiers**: `contains`, `endswith`, `startswith`, `re`, `cidr`,
14//!   `base64`, `base64offset`, `wide`, `windash`, `all`, `cased`, `exists`, `fieldref`,
15//!   comparison operators, regex flags, timestamp parts, and more
16//!
17//! ## Architecture
18//!
19//! - **PEG grammar** ([`pest`]) for condition expression parsing with correct operator
20//!   precedence (`NOT` > `AND` > `OR`) and Pratt parsing
21//! - **serde_yaml** for YAML structure deserialization
22//! - **Custom parsing** for field modifiers, wildcard strings, and timespan values
23//!
24//! ## Quick Start
25//!
26//! ```rust
27//! use rsigma_parser::parse_sigma_yaml;
28//!
29//! let yaml = r#"
30//! title: Detect Whoami
31//! logsource:
32//!     product: windows
33//!     category: process_creation
34//! detection:
35//!     selection:
36//!         CommandLine|contains: 'whoami'
37//!     condition: selection
38//! level: medium
39//! "#;
40//!
41//! let collection = parse_sigma_yaml(yaml).unwrap();
42//! assert_eq!(collection.rules.len(), 1);
43//! assert_eq!(collection.rules[0].title, "Detect Whoami");
44//! ```
45//!
46//! ## Parsing condition expressions
47//!
48//! ```rust
49//! use rsigma_parser::parse_condition;
50//!
51//! let expr = parse_condition("selection_main and 1 of selection_dword_* and not 1 of filter_*").unwrap();
52//! println!("{expr}");
53//! ```
54
55pub mod ast;
56pub mod condition;
57pub mod error;
58pub mod lint;
59pub mod parser;
60pub mod value;
61
62// Re-export the most commonly used types and functions at crate root
63pub use ast::{
64    ConditionExpr, ConditionOperator, CorrelationCondition, CorrelationRule, CorrelationType,
65    Detection, DetectionItem, Detections, FieldAlias, FieldSpec, FilterRule, Level, LogSource,
66    Modifier, Quantifier, Related, RelationType, SelectorPattern, SigmaCollection, SigmaDocument,
67    SigmaRule, Status,
68};
69pub use condition::parse_condition;
70pub use error::{Result, SigmaParserError};
71pub use lint::{
72    FileLintResult, InlineSuppressions, LintConfig, LintRule, LintWarning, Severity, Span,
73    apply_suppressions, lint_yaml_directory, lint_yaml_directory_with_config, lint_yaml_file,
74    lint_yaml_file_with_config, lint_yaml_str, lint_yaml_str_with_config, lint_yaml_value,
75    parse_inline_suppressions,
76};
77pub use parser::{parse_field_spec, parse_sigma_directory, parse_sigma_file, parse_sigma_yaml};
78pub use value::{SigmaString, SigmaValue, SpecialChar, StringPart, Timespan};
rsigma_parser/lib.rs

rsigma_parser/
lib.rs
