misp-modules/misp_modules/modules/expansion/sigma_syntax_validator.py

39 lines
1.2 KiB
Python
Raw Normal View History

import json
try:
import yaml
2019-01-21 14:06:38 +01:00
from sigma.parser.rule import SigmaParser
from sigma.configuration import SigmaConfiguration
except ImportError:
print("sigma or yaml is missing, use 'pip3 install sigmatools' to install it.")
misperrors = {'error': 'Error'}
mispattributes = {'input': ['sigma'], 'output': ['text']}
moduleinfo = {'version': '0.1', 'author': 'Christian Studer', 'module-type': ['expansion', 'hover'],
'description': 'An expansion hover module to perform a syntax check on sigma rules'}
moduleconfig = []
2018-12-11 15:29:09 +01:00
def handler(q=False):
if q is False:
return False
request = json.loads(q)
if not request.get('sigma'):
misperrors['error'] = 'Sigma rule missing'
return misperrors
config = SigmaConfiguration()
try:
parser = SigmaParser(yaml.safe_load(request.get('sigma')), config)
result = ("Syntax valid: {}".format(parser.values))
except Exception as e:
result = ("Syntax error: {}".format(str(e)))
return {'results': [{'types': mispattributes['output'], 'values': result}]}
2018-12-11 15:29:09 +01:00
def introspection():
return mispattributes
2018-12-11 15:29:09 +01:00
def version():
moduleinfo['config'] = moduleconfig
return moduleinfo