detkit-cli 0.1.1__tar.gz → 0.1.4__tar.gz

detkit_cli-0.1.4/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,20 @@
+---
+name: Bug report
+about: A rule evaluates the wrong way, or detkit crashes
+labels: bug
+---
+
+**The rule** — paste the Sigma (a minimal version is fine):
+
+```yaml
+
+```
+
+**The event and what you expected** — the sample event, whether it should match or not, and what detkit did instead:
+
+```yaml
+
+```
+
+**Version:** output of `detkit --version`
+**Command:** how you ran it, e.g. `detkit test rules`

detkit_cli-0.1.4/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,15 @@
+---
+name: Feature request
+about: Suggest something detkit should do
+labels: enhancement
+---
+
+**What are you trying to do?** Describe the workflow, not just the feature.
+
+**What would help?**
+
+**A Sigma rule or example, if it's relevant:**
+
+```yaml
+
+```

detkit_cli-0.1.4/.github/workflows/ci.yml

@@ -0,0 +1,21 @@
+name: CI
+on: [push, pull_request]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ['3.9', '3.12']
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0        
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: pip install -e .
+      - name: Unit checks (evaluator core)
+        run: python tests/test_evaluator.py
+      - name: Example rules must pass their tests
+        run: detkit test examples/rules

detkit_cli-0.1.4/.github/workflows/publish.yml

@@ -0,0 +1,34 @@
+name: Publish to PyPI
+
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write        
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0        
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+
+      - name: Build
+        run: |
+          pip install build
+          python -m build
+
+      - name: Don't ship a broken build
+        run: |
+          pip install dist/*.whl
+          python tests/test_evaluator.py
+          detkit test examples/rules
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

detkit_cli-0.1.4/.gitignore

@@ -0,0 +1,9 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+build/
+dist/
+.venv/
+venv/
+.pytest_cache/
+.eggs/

detkit_cli-0.1.4/.pre-commit-hooks.yaml

@@ -0,0 +1,26 @@
+# Lets other repos use detkit as a pre-commit hook. In a consuming repo's
+# .pre-commit-config.yaml:
+#
+#   repos:
+#     - repo: https://github.com/ELSATOAH/detkit
+#       rev: v0.1.3
+#       hooks:
+#         - id: detkit-test
+#           args: [rules]      # path to your rules
+- id: detkit-test
+  name: detkit test
+  description: Test Sigma detection rules against their sample events
+  entry: detkit test
+  language: python
+  types: [yaml]
+  args: [rules]
+  pass_filenames: false
+
+- id: detkit-validate
+  name: detkit validate
+  description: Structurally validate Sigma detection rules
+  entry: detkit validate
+  language: python
+  types: [yaml]
+  args: [rules]
+  pass_filenames: false

detkit_cli-0.1.4/CONTRIBUTING.md

@@ -0,0 +1,44 @@
+# Contributing to detkit
+
+Thanks for helping out. detkit is small on purpose, so getting started is quick.
+
+## Setup
+
+```bash
+git clone https://github.com/ELSATOAH/detkit
+cd detkit
+pip install -e .                    # a venv or pipx works too
+python3 tests/test_evaluator.py     # the whole test suite, no framework needed
+detkit test examples/rules          # should print all green
+```
+
+## Where things live
+
+- `detkit/evaluator.py` — the core: evaluate a Sigma `detection`/`condition` against one event. Most changes go here.
+- `detkit/cli.py` — the `test` / `validate` / `init` commands.
+- `tests/test_evaluator.py` — plain `assert`s; run it directly or with pytest.
+- `examples/rules/` — a rule and its `*.test.yml`, which doubles as a spec for the format.
+
+## The one rule
+
+Never return a confident wrong answer. What the evaluator can't handle yet is listed by `scan_unsupported()` and printed as a `WARN` at runtime instead of guessing. If you add a feature, either handle it properly or leave the warning in place.
+
+## Adding support for a Sigma feature
+
+1. Add the logic in `evaluator.py` — `_match_scalar` for modifiers, `_resolve_field` for field access, `_eval_condition` for conditions.
+2. If it was in `scan_unsupported()`'s warn list, drop it from there.
+3. Add a test: one event that should match, one that shouldn't.
+
+Known ceilings are marked with `# ponytail:` comments in `evaluator.py`.
+
+## Good places to start
+
+- `|base64` / `|base64offset` modifier support (currently warns).
+- Nested fields that descend into arrays of objects (right now it only walks dicts).
+- A `--json` output mode for `detkit test`, for pipelines that want structured results.
+
+## Releases
+
+Maintainers only, and it's one step: `gh release create vX.Y.Z --generate-notes`. The tag sets the version (setuptools-scm) and GitHub Actions builds and publishes to PyPI.
+
+MIT licensed. By contributing, you agree your work ships under it.

{detkit_cli-0.1.1 → detkit_cli-0.1.4}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: detkit-cli
-Version: 0.1.1
+Version: 0.1.4
 Summary: dbt for detections — test, validate, and CI-gate Sigma detection rules as code.
 Author: detkit
-License: MIT
+License-Expression: MIT
 Project-URL: Homepage, https://github.com/ELSATOAH/detkit
 Project-URL: Repository, https://github.com/ELSATOAH/detkit
 Project-URL: Issues, https://github.com/ELSATOAH/detkit/issues
@@ -11,7 +11,6 @@ Keywords: sigma,detection-engineering,detection-as-code,siem,security,detections
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Information Technology
 Classifier: Topic :: Security
-Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.9
@@ -22,7 +21,7 @@ Dynamic: license-file
 
 # detkit
 
-[![CI](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml/badge.svg)](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml) [![PyPI](https://img.shields.io/pypi/v/detkit-cli)](https://pypi.org/project/detkit-cli/) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/ELSATOAH/detkit/blob/main/LICENSE)
+[![CI](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml/badge.svg)](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml) [![PyPI](https://img.shields.io/pypi/v/detkit-cli)](https://pypi.org/project/detkit-cli/) [![Python](https://img.shields.io/pypi/pyversions/detkit-cli)](https://pypi.org/project/detkit-cli/) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/ELSATOAH/detkit/blob/main/LICENSE)
 
 Unit tests for your Sigma detection rules. Write a rule, add a couple of example log events, and detkit tells you whether it fires on the ones that should trip it and stays quiet on the ones that shouldn't. Wire it into CI and a broken detection fails the pull request instead of failing silently in production.
 
@@ -90,6 +89,22 @@ jobs:
           path: rules
 ```
 
+## pre-commit
+
+Prefer to catch it before the commit lands? Add detkit to your [pre-commit](https://pre-commit.com) config:
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/ELSATOAH/detkit
+    rev: v0.1.3
+    hooks:
+      - id: detkit-test
+        args: [rules]   # path to your rules
+```
+
+There's a `detkit-validate` hook too, for the lighter structural check.
+
 ## What it handles
 
 detkit runs your rules locally. No SIEM, no credentials, nothing leaves your machine or CI runner. I ran it against every rule in the SigmaHQ repo, and about 91% use only features it understands today: `contains`, `startswith`, `endswith`, `re`, value wildcards (`*` and `?`), `|cidr`, keyword lists, and `X of` / `all of` conditions.

{detkit_cli-0.1.1 → detkit_cli-0.1.4}/README.md

@@ -1,6 +1,6 @@
 # detkit
 
-[![CI](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml/badge.svg)](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml) [![PyPI](https://img.shields.io/pypi/v/detkit-cli)](https://pypi.org/project/detkit-cli/) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/ELSATOAH/detkit/blob/main/LICENSE)
+[![CI](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml/badge.svg)](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml) [![PyPI](https://img.shields.io/pypi/v/detkit-cli)](https://pypi.org/project/detkit-cli/) [![Python](https://img.shields.io/pypi/pyversions/detkit-cli)](https://pypi.org/project/detkit-cli/) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/ELSATOAH/detkit/blob/main/LICENSE)
 
 Unit tests for your Sigma detection rules. Write a rule, add a couple of example log events, and detkit tells you whether it fires on the ones that should trip it and stays quiet on the ones that shouldn't. Wire it into CI and a broken detection fails the pull request instead of failing silently in production.
 
@@ -68,6 +68,22 @@ jobs:
           path: rules
 ```
 
+## pre-commit
+
+Prefer to catch it before the commit lands? Add detkit to your [pre-commit](https://pre-commit.com) config:
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/ELSATOAH/detkit
+    rev: v0.1.3
+    hooks:
+      - id: detkit-test
+        args: [rules]   # path to your rules
+```
+
+There's a `detkit-validate` hook too, for the lighter structural check.
+
 ## What it handles
 
 detkit runs your rules locally. No SIEM, no credentials, nothing leaves your machine or CI runner. I ran it against every rule in the SigmaHQ repo, and about 91% use only features it understands today: `contains`, `startswith`, `endswith`, `re`, value wildcards (`*` and `?`), `|cidr`, keyword lists, and `X of` / `all of` conditions.

detkit_cli-0.1.4/action.yml

@@ -0,0 +1,27 @@
+name: 'detkit — test detections'
+description: 'Run detkit against your Sigma detection rules to gate pull requests in CI.'
+branding:
+  icon: 'shield'
+  color: 'purple'
+inputs:
+  path:
+    description: 'Directory containing your Sigma rules and their *.test.yml files.'
+    required: false
+    default: '.'
+  command:
+    description: 'Which detkit command to run: test or validate.'
+    required: false
+    default: 'test'
+runs:
+  using: 'composite'
+  steps:
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: '3.11'
+    - name: Install detkit
+      shell: bash
+      run: pip install "${{ github.action_path }}"
+    - name: Run detkit
+      shell: bash
+      run: detkit "${{ inputs.command }}" "${{ inputs.path }}"

detkit_cli-0.1.4/detkit/__init__.py

@@ -0,0 +1,6 @@
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("detkit-cli")
+except PackageNotFoundError:
+    __version__ = "0+unknown"

{detkit_cli-0.1.1 → detkit_cli-0.1.4}/detkit/cli.py

@@ -5,8 +5,18 @@ import os
 import re
 import sys
 
+from . import __version__
 from .evaluator import event_matches_rule, scan_unsupported
 
+# Color only when writing to a terminal, and honor the NO_COLOR convention,
+# so piped and CI output stays plain.
+_COLOR = sys.stdout.isatty() and not os.environ.get("NO_COLOR")
+_GREEN, _RED, _YELLOW, _DIM = "32", "31", "33", "2"
+
+
+def _c(text, code):
+    return f"\033[{code}m{text}\033[0m" if _COLOR else text
+
 REQUIRED_KEYS = ("title", "logsource", "detection")
 
 
@@ -47,11 +57,11 @@ def cmd_test(args):
         detection = (rule or {}).get("detection")
         if isinstance(detection, dict):
             for warn in scan_unsupported(detection):
-                print(f"  ! {rule_path}  WARN: {warn} (result may be unreliable)")
+                print(f"  {_c('!', _YELLOW)} {rule_path}  WARN: {warn} (result may be unreliable)")
         test_path = _test_file_for(rule_path)
         if not test_path:
             untested += 1
-            print(f"  ? {rule_path}  (no .test.yml)")
+            print(f"  {_c('?', _DIM)} {rule_path}  (no .test.yml)")
             continue
         cases = (_load_yaml(test_path) or {}).get("tests", [])
         for case in cases:
@@ -60,18 +70,19 @@ def cmd_test(args):
                 got = event_matches_rule(detection, case.get("event", {}))
             except Exception as exc:  # a rule error should fail the test, not crash the run
                 failed += 1
-                print(f"  x {rule_path} :: {case.get('name', '?')}  ERROR: {exc}")
+                print(f"  {_c('x', _RED)} {rule_path} :: {case.get('name', '?')}  ERROR: {exc}")
                 continue
             if got == want:
                 passed += 1
-                print(f"  . {rule_path} :: {case.get('name', '?')}")
+                print(f"  {_c('.', _GREEN)} {rule_path} :: {case.get('name', '?')}")
             else:
                 failed += 1
                 verb = "fired" if got else "did not fire"
-                print(f"  x {rule_path} :: {case.get('name', '?')}  (rule {verb}, expected {case['expect']})")
+                print(f"  {_c('x', _RED)} {rule_path} :: {case.get('name', '?')}  (rule {verb}, expected {case['expect']})")
     tested = len(rules) - untested
     pct = round(100 * tested / len(rules)) if rules else 0
-    print(f"\n{passed} passed, {failed} failed")
+    failed_str = _c(f"{failed} failed", _RED) if failed else f"{failed} failed"
+    print(f"\n{_c(f'{passed} passed', _GREEN)}, {failed_str}")
     print(f"{tested} of {len(rules)} rules have tests ({pct}% coverage)")
     return 1 if failed else 0
 
@@ -113,7 +124,8 @@ def cmd_validate(args):
         warns = scan_unsupported(detection) if isinstance(detection, dict) else []
         total_errors += len(errors)
         total_warnings += len(warns)
-        print(f"  {'x' if errors else '!' if warns else '.'} {rule_path}")
+        marker = _c("x", _RED) if errors else _c("!", _YELLOW) if warns else _c(".", _GREEN)
+        print(f"  {marker} {rule_path}")
         for e in errors:
             print(f"      - error: {e}")
         for w in warns:
@@ -204,6 +216,7 @@ def cmd_generate(args):
 
 def main(argv=None):
     parser = argparse.ArgumentParser(prog="detkit", description="Test Sigma detection rules as code.")
+    parser.add_argument("--version", action="version", version=f"detkit {__version__}")
     sub = parser.add_subparsers(dest="cmd", required=True)
 
     p_test = sub.add_parser("test", help="run rule tests against sample events")

{detkit_cli-0.1.1 → detkit_cli-0.1.4}/detkit/evaluator.py

@@ -4,9 +4,10 @@ This is the core of detkit: unit-testing detection rules locally, the way
 dbt tests data models. It implements the common Sigma subset.
 
 # ponytail: common-subset evaluator (modifiers contains/startswith/endswith/re/cased/all/cidr,
-# value wildcards * and ?, list-OR, `N of them | N of prefix*`, and/or/not/parens). Ceilings:
-# no nested-field (dot) access, no |base64/|windash modifiers, no count()/timeframe aggregation,
-# matching is case-insensitive by default (real SIEM backends differ). Anything unsupported is
+# value wildcards * and ?, dotted field paths a.b.c into nested events, list-OR,
+# `N of them | N of prefix*`, and/or/not/parens). Ceilings: no |base64/|windash modifiers,
+# no count()/timeframe aggregation, no descent into arrays of objects, matching is
+# case-insensitive by default (real SIEM backends differ). Anything unsupported is
 # reported by scan_unsupported() so it fails loud instead of returning a wrong boolean. Upgrade
 # path: delegate to pySigma pipelines or a per-backend evaluator when a rule needs the full spec.
 """
@@ -48,15 +49,31 @@ def _matches_map(spec: dict, event: dict) -> bool:
 def _matches_field(key: str, expected, event: dict) -> bool:
     parts = key.split("|")
     field, mods = parts[0], [m.lower() for m in parts[1:]]
-    if field not in event:
+    found, ev = _resolve_field(field, event)
+    if not found:
         return False
-    ev = event[field]
     if isinstance(expected, list):
         results = [_match_scalar(ev, x, mods) for x in expected]
         return all(results) if "all" in mods else any(results)
     return _match_scalar(ev, expected, mods)
 
 
+def _resolve_field(field: str, event):
+    # Exact key first — covers flattened logs that use a literal dotted key
+    # (e.g. Elastic/ECS "gcp.audit.method_name"). Otherwise walk a.b.c into nested dicts.
+    if isinstance(event, dict) and field in event:
+        return True, event[field]
+    if "." in field and isinstance(event, dict):
+        cur = event
+        for part in field.split("."):
+            if isinstance(cur, dict) and part in cur:
+                cur = cur[part]
+            else:
+                return False, None
+        return True, cur
+    return False, None
+
+
 def _match_scalar(ev, expected, mods) -> bool:
     cased = "cased" in mods
     if "cidr" in mods:
@@ -123,9 +140,6 @@ def scan_unsupported(detection: dict) -> list:
             if mod not in _SUPPORTED_MODS and ("m", mod) not in seen:
                 seen.add(("m", mod))
                 findings.append(f"unsupported modifier '|{mod}' (on '{field}')")
-        if "." in field and ("f", field) not in seen:
-            seen.add(("f", field))
-            findings.append(f"nested/dotted field '{field}' (matched only as a flat key)")
 
     def walk(spec):
         if isinstance(spec, dict):

detkit_cli-0.1.4/detkit-demo.tape

@@ -0,0 +1,51 @@
+# detkit demo — generate the GIF with:  vhs detkit-demo.tape
+# Prereqs: `go install github.com/charmbracelet/vhs@latest` (or brew install vhs),
+#          run from the detkit repo root, and `pip install -e .` first.
+# Uses GNU sed (Linux/WSL). On macOS, change `sed -i` to `sed -i ''`.
+
+Output detkit-demo.gif
+
+Require detkit
+
+Set Shell bash
+Set Theme "Dracula"
+Set FontSize 18
+Set Width 1200
+Set Height 680
+Set Padding 24
+Set TypingSpeed 45ms
+
+Hide
+Type "clear"
+Enter
+Show
+
+Type "# A Sigma rule ships with sample events saying what it should catch:"
+Enter
+Sleep 1s
+Type "detkit test examples/rules"
+Enter
+Sleep 3s
+
+Type "# A teammate 'tidies up' the rule and quietly breaks the detection..."
+Enter
+Sleep 1s
+Type "sed -i 's/whoami/whoamiXYZ/' examples/rules/whoami_execution.yml"
+Enter
+Sleep 1200ms
+
+Type "# detkit catches it. Non-zero exit means CI blocks the pull request:"
+Enter
+Sleep 800ms
+Type "detkit test examples/rules; echo exit=$?"
+Enter
+Sleep 4s
+
+Type "# Revert -> green again."
+Enter
+Sleep 800ms
+Type "sed -i 's/whoamiXYZ/whoami/' examples/rules/whoami_execution.yml"
+Enter
+Type "detkit test examples/rules; echo exit=$?"
+Enter
+Sleep 3500ms

{detkit_cli-0.1.1 → detkit_cli-0.1.4}/detkit_cli.egg-info/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: detkit-cli
-Version: 0.1.1
+Version: 0.1.4
 Summary: dbt for detections — test, validate, and CI-gate Sigma detection rules as code.
 Author: detkit
-License: MIT
+License-Expression: MIT
 Project-URL: Homepage, https://github.com/ELSATOAH/detkit
 Project-URL: Repository, https://github.com/ELSATOAH/detkit
 Project-URL: Issues, https://github.com/ELSATOAH/detkit/issues
@@ -11,7 +11,6 @@ Keywords: sigma,detection-engineering,detection-as-code,siem,security,detections
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Information Technology
 Classifier: Topic :: Security
-Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.9
@@ -22,7 +21,7 @@ Dynamic: license-file
 
 # detkit
 
-[![CI](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml/badge.svg)](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml) [![PyPI](https://img.shields.io/pypi/v/detkit-cli)](https://pypi.org/project/detkit-cli/) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/ELSATOAH/detkit/blob/main/LICENSE)
+[![CI](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml/badge.svg)](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml) [![PyPI](https://img.shields.io/pypi/v/detkit-cli)](https://pypi.org/project/detkit-cli/) [![Python](https://img.shields.io/pypi/pyversions/detkit-cli)](https://pypi.org/project/detkit-cli/) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/ELSATOAH/detkit/blob/main/LICENSE)
 
 Unit tests for your Sigma detection rules. Write a rule, add a couple of example log events, and detkit tells you whether it fires on the ones that should trip it and stays quiet on the ones that shouldn't. Wire it into CI and a broken detection fails the pull request instead of failing silently in production.
 
@@ -90,6 +89,22 @@ jobs:
           path: rules
 ```
 
+## pre-commit
+
+Prefer to catch it before the commit lands? Add detkit to your [pre-commit](https://pre-commit.com) config:
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/ELSATOAH/detkit
+    rev: v0.1.3
+    hooks:
+      - id: detkit-test
+        args: [rules]   # path to your rules
+```
+
+There's a `detkit-validate` hook too, for the lighter structural check.
+
 ## What it handles
 
 detkit runs your rules locally. No SIEM, no credentials, nothing leaves your machine or CI runner. I ran it against every rule in the SigmaHQ repo, and about 91% use only features it understands today: `contains`, `startswith`, `endswith`, `re`, value wildcards (`*` and `?`), `|cidr`, keyword lists, and `X of` / `all of` conditions.

detkit_cli-0.1.4/detkit_cli.egg-info/SOURCES.txt

@@ -0,0 +1,28 @@
+.gitignore
+.pre-commit-hooks.yaml
+CONTRIBUTING.md
+LICENSE
+README.md
+action.yml
+detkit-demo.gif
+detkit-demo.tape
+pyproject.toml
+.github/ISSUE_TEMPLATE/bug_report.md
+.github/ISSUE_TEMPLATE/feature_request.md
+.github/workflows/ci.yml
+.github/workflows/publish.yml
+detkit/__init__.py
+detkit/__main__.py
+detkit/cli.py
+detkit/evaluator.py
+detkit_cli.egg-info/PKG-INFO
+detkit_cli.egg-info/SOURCES.txt
+detkit_cli.egg-info/dependency_links.txt
+detkit_cli.egg-info/entry_points.txt
+detkit_cli.egg-info/requires.txt
+detkit_cli.egg-info/scm_file_list.json
+detkit_cli.egg-info/scm_version.json
+detkit_cli.egg-info/top_level.txt
+examples/rules/whoami_execution.test.yml
+examples/rules/whoami_execution.yml
+tests/test_evaluator.py

detkit_cli-0.1.4/detkit_cli.egg-info/scm_file_list.json

@@ -0,0 +1,24 @@
+{
+  "files": [
+    ".gitignore",
+    "detkit-demo.tape",
+    "README.md",
+    "action.yml",
+    "CONTRIBUTING.md",
+    "pyproject.toml",
+    "detkit-demo.gif",
+    "LICENSE",
+    ".pre-commit-hooks.yaml",
+    ".github/workflows/publish.yml",
+    ".github/workflows/ci.yml",
+    ".github/ISSUE_TEMPLATE/bug_report.md",
+    ".github/ISSUE_TEMPLATE/feature_request.md",
+    "examples/rules/whoami_execution.yml",
+    "examples/rules/whoami_execution.test.yml",
+    "detkit/evaluator.py",
+    "detkit/__main__.py",
+    "detkit/cli.py",
+    "detkit/__init__.py",
+    "tests/test_evaluator.py"
+  ]
+}

detkit_cli-0.1.4/detkit_cli.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "0.1.4",
+  "distance": 0,
+  "node": "g80ef32737be8e15897b06afcf76eeb397325fcb4",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-07-20"
+}

detkit_cli-0.1.4/examples/rules/whoami_execution.test.yml

@@ -0,0 +1,23 @@
+# Unit tests for whoami_execution.yml
+# every detection ships with sample events proving it fires (and doesn't).
+tests:
+  - name: fires on whoami run by a normal user
+    event:
+      EventID: 4688
+      CommandLine: "cmd /c whoami /all"
+      User: "alice"
+    expect: match
+
+  - name: suppressed for SYSTEM (the filter)
+    event:
+      EventID: 4688
+      CommandLine: "whoami"
+      User: "SYSTEM"
+    expect: no_match
+
+  - name: no match on an unrelated command
+    event:
+      EventID: 4688
+      CommandLine: "ipconfig /all"
+      User: "alice"
+    expect: no_match

detkit_cli-0.1.4/examples/rules/whoami_execution.yml

@@ -0,0 +1,15 @@
+title: Whoami Execution
+id: 6f0c3f2e-2a5e-4a1e-9b3a-0d5f1a2b3c4d
+status: experimental
+description: Detects execution of whoami.exe, common in post-exploitation recon.
+logsource:
+  category: process_creation
+  product: windows
+detection:
+  selection:
+    EventID: 4688
+    CommandLine|contains: 'whoami'
+  filter:
+    User: 'SYSTEM'
+  condition: selection and not filter
+level: low

{detkit_cli-0.1.1 → detkit_cli-0.1.4}/pyproject.toml

@@ -1,36 +1,37 @@
-[project]
-name = "detkit-cli"
-version = "0.1.1"
-description = "dbt for detections — test, validate, and CI-gate Sigma detection rules as code."
-readme = "README.md"
-requires-python = ">=3.9"
-license = { text = "MIT" }
-authors = [{ name = "detkit" }]
-keywords = [
-    "sigma", "detection-engineering", "detection-as-code",
-    "siem", "security", "detections", "blue-team", "cybersecurity",
-]
-classifiers = [
-    "Development Status :: 3 - Alpha",
-    "Intended Audience :: Information Technology",
-    "Topic :: Security",
-    "License :: OSI Approved :: MIT License",
-    "Programming Language :: Python :: 3",
-    "Operating System :: OS Independent",
-]
-dependencies = ["pyyaml>=6"]
-
-[project.urls]
-Homepage = "https://github.com/ELSATOAH/detkit"
-Repository = "https://github.com/ELSATOAH/detkit"
-Issues = "https://github.com/ELSATOAH/detkit/issues"
-
-[project.scripts]
-detkit = "detkit.cli:main"
-
-[build-system]
-requires = ["setuptools>=61"]
-build-backend = "setuptools.build_meta"
-
-[tool.setuptools.packages.find]
-include = ["detkit*"]
+[project]
+name = "detkit-cli"
+dynamic = ["version"]        
+description = "dbt for detections — test, validate, and CI-gate Sigma detection rules as code."
+readme = "README.md"
+requires-python = ">=3.9"
+license = "MIT"
+authors = [{ name = "detkit" }]
+keywords = [
+    "sigma", "detection-engineering", "detection-as-code",
+    "siem", "security", "detections", "blue-team", "cybersecurity",
+]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Information Technology",
+    "Topic :: Security",
+    "Programming Language :: Python :: 3",
+    "Operating System :: OS Independent",
+]
+dependencies = ["pyyaml>=6"]
+
+[project.urls]
+Homepage = "https://github.com/ELSATOAH/detkit"
+Repository = "https://github.com/ELSATOAH/detkit"
+Issues = "https://github.com/ELSATOAH/detkit/issues"
+
+[project.scripts]
+detkit = "detkit.cli:main"
+
+[build-system]
+requires = ["setuptools>=77", "setuptools-scm>=8"]
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools.packages.find]
+include = ["detkit*"]
+
+[tool.setuptools_scm]

{detkit_cli-0.1.1 → detkit_cli-0.1.4}/tests/test_evaluator.py

@@ -92,16 +92,29 @@ def test_cidr_modifier():
 
 
 def test_scan_flags_unsupported():
-    det = {
-        "sel": {"CommandLine|base64offset|contains": "abc", "id.orig_h": "1.2.3.4"},
-        "condition": "sel",
-    }
+    det = {"sel": {"CommandLine|base64offset|contains": "abc"}, "condition": "sel"}
     findings = scan_unsupported(det)
     assert any("base64offset" in f for f in findings)
-    assert any("id.orig_h" in f for f in findings)
+    # nested/dotted fields are supported now, so they must NOT be flagged
+    assert scan_unsupported({"sel": {"id.orig_h": "1.2.3.4"}, "condition": "sel"}) == []
     assert scan_unsupported({"sel": {"EventID": 1}, "condition": "sel"}) == []
 
 
+def test_nested_field_access():
+    det = {"sel": {"DeviceDetail.deviceId": "abc123"}, "condition": "sel"}
+    assert event_matches_rule(det, {"DeviceDetail": {"deviceId": "abc123"}})   # nested dict
+    assert event_matches_rule(det, {"DeviceDetail.deviceId": "abc123"})        # flattened key
+    assert not event_matches_rule(det, {"DeviceDetail": {"deviceId": "other"}})
+    assert not event_matches_rule(det, {"DeviceDetail": {}})
+    assert not event_matches_rule(det, {"EventID": 1})
+
+
+def test_nested_field_with_modifier():
+    det = {"sel": {"gcp.audit.method_name|endswith": ".delete"}, "condition": "sel"}
+    assert event_matches_rule(det, {"gcp": {"audit": {"method_name": "v1.compute.firewalls.delete"}}})
+    assert not event_matches_rule(det, {"gcp": {"audit": {"method_name": "v1.compute.firewalls.list"}}})
+
+
 if __name__ == "__main__":
     fns = [v for k, v in sorted(globals().items()) if k.startswith("test_") and callable(v)]
     for fn in fns:

detkit_cli-0.1.1/detkit/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.1.0"

detkit_cli-0.1.1/detkit_cli.egg-info/SOURCES.txt

@@ -1,14 +0,0 @@
-LICENSE
-README.md
-pyproject.toml
-detkit/__init__.py
-detkit/__main__.py
-detkit/cli.py
-detkit/evaluator.py
-detkit_cli.egg-info/PKG-INFO
-detkit_cli.egg-info/SOURCES.txt
-detkit_cli.egg-info/dependency_links.txt
-detkit_cli.egg-info/entry_points.txt
-detkit_cli.egg-info/requires.txt
-detkit_cli.egg-info/top_level.txt
-tests/test_evaluator.py