Skip to main content

Module condition

Module condition 

Source
Expand description

Condition expression parser using pest PEG grammar + Pratt parser.

Parses Sigma condition strings like:

  • "selection and not filter"
  • "1 of selection_* and not 1 of filter_*"
  • "all of them"
  • "selection_main and 1 of selection_dword_* and not 1 of filter_optional_*"

Reference: pySigma conditions.py (uses pyparsing infix_notation)

Enums§

Rule

Functions§

parse_condition
Parse a Sigma condition expression string into an AST.