detkit-cli 0.1.3__tar.gz → 0.1.5__tar.gz

detkit_cli-0.1.5/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,20 @@
+---
+name: Bug report
+about: A rule evaluates the wrong way, or detkit crashes
+labels: bug
+---
+
+**The rule** — paste the Sigma (a minimal version is fine):
+
+```yaml
+
+```
+
+**The event and what you expected** — the sample event, whether it should match or not, and what detkit did instead:
+
+```yaml
+
+```
+
+**Version:** output of `detkit --version`
+**Command:** how you ran it, e.g. `detkit test rules`

detkit_cli-0.1.5/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,15 @@
+---
+name: Feature request
+about: Suggest something detkit should do
+labels: enhancement
+---
+
+**What are you trying to do?** Describe the workflow, not just the feature.
+
+**What would help?**
+
+**A Sigma rule or example, if it's relevant:**
+
+```yaml
+
+```

{detkit_cli-0.1.3 → detkit_cli-0.1.5}/.github/workflows/ci.yml

@@ -14,8 +14,8 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
-      - run: pip install -e .
-      - name: Unit checks (evaluator core)
-        run: python tests/test_evaluator.py
+      - run: pip install -e . pytest
+      - name: Run the test suite
+        run: pytest -q
       - name: Example rules must pass their tests
         run: detkit test examples/rules

detkit_cli-0.1.5/.pre-commit-hooks.yaml

@@ -0,0 +1,26 @@
+# Lets other repos use detkit as a pre-commit hook. In a consuming repo's
+# .pre-commit-config.yaml:
+#
+#   repos:
+#     - repo: https://github.com/ELSATOAH/detkit
+#       rev: v0.1.3
+#       hooks:
+#         - id: detkit-test
+#           args: [rules]      # path to your rules
+- id: detkit-test
+  name: detkit test
+  description: Test Sigma detection rules against their sample events
+  entry: detkit test
+  language: python
+  types: [yaml]
+  args: [rules]
+  pass_filenames: false
+
+- id: detkit-validate
+  name: detkit validate
+  description: Structurally validate Sigma detection rules
+  entry: detkit validate
+  language: python
+  types: [yaml]
+  args: [rules]
+  pass_filenames: false

detkit_cli-0.1.5/CONTRIBUTING.md

@@ -0,0 +1,44 @@
+# Contributing to detkit
+
+Thanks for helping out. detkit is small on purpose, so getting started is quick.
+
+## Setup
+
+```bash
+git clone https://github.com/ELSATOAH/detkit
+cd detkit
+pip install -e .                    # a venv or pipx works too
+python3 tests/test_evaluator.py     # the whole test suite, no framework needed
+detkit test examples/rules          # should print all green
+```
+
+## Where things live
+
+- `detkit/evaluator.py` — the core: evaluate a Sigma `detection`/`condition` against one event. Most changes go here.
+- `detkit/cli.py` — the `test` / `validate` / `init` commands.
+- `tests/test_evaluator.py` — plain `assert`s; run it directly or with pytest.
+- `examples/rules/` — a rule and its `*.test.yml`, which doubles as a spec for the format.
+
+## The one rule
+
+Never return a confident wrong answer. What the evaluator can't handle yet is listed by `scan_unsupported()` and printed as a `WARN` at runtime instead of guessing. If you add a feature, either handle it properly or leave the warning in place.
+
+## Adding support for a Sigma feature
+
+1. Add the logic in `evaluator.py` — `_match_scalar` for modifiers, `_resolve_field` for field access, `_eval_condition` for conditions.
+2. If it was in `scan_unsupported()`'s warn list, drop it from there.
+3. Add a test: one event that should match, one that shouldn't.
+
+Known ceilings are marked with `# ponytail:` comments in `evaluator.py`.
+
+## Good places to start
+
+- `|base64` / `|base64offset` modifier support (currently warns).
+- Nested fields that descend into arrays of objects (right now it only walks dicts).
+- A `--json` output mode for `detkit test`, for pipelines that want structured results.
+
+## Releases
+
+Maintainers only, and it's one step: `gh release create vX.Y.Z --generate-notes`. The tag sets the version (setuptools-scm) and GitHub Actions builds and publishes to PyPI.
+
+MIT licensed. By contributing, you agree your work ships under it.

{detkit_cli-0.1.3 → detkit_cli-0.1.5}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: detkit-cli
-Version: 0.1.3
+Version: 0.1.5
 Summary: dbt for detections — test, validate, and CI-gate Sigma detection rules as code.
 Author: detkit
-License: MIT
+License-Expression: MIT
 Project-URL: Homepage, https://github.com/ELSATOAH/detkit
 Project-URL: Repository, https://github.com/ELSATOAH/detkit
 Project-URL: Issues, https://github.com/ELSATOAH/detkit/issues
@@ -11,7 +11,6 @@ Keywords: sigma,detection-engineering,detection-as-code,siem,security,detections
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Information Technology
 Classifier: Topic :: Security
-Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.9
@@ -22,7 +21,7 @@ Dynamic: license-file
 
 # detkit
 
-[![CI](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml/badge.svg)](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml) [![PyPI](https://img.shields.io/pypi/v/detkit-cli)](https://pypi.org/project/detkit-cli/) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/ELSATOAH/detkit/blob/main/LICENSE)
+[![CI](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml/badge.svg)](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml) [![PyPI](https://img.shields.io/pypi/v/detkit-cli)](https://pypi.org/project/detkit-cli/) [![Python](https://img.shields.io/pypi/pyversions/detkit-cli)](https://pypi.org/project/detkit-cli/) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/ELSATOAH/detkit/blob/main/LICENSE)
 
 Unit tests for your Sigma detection rules. Write a rule, add a couple of example log events, and detkit tells you whether it fires on the ones that should trip it and stays quiet on the ones that shouldn't. Wire it into CI and a broken detection fails the pull request instead of failing silently in production.
 
@@ -90,6 +89,22 @@ jobs:
           path: rules
 ```
 
+## pre-commit
+
+Prefer to catch it before the commit lands? Add detkit to your [pre-commit](https://pre-commit.com) config:
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/ELSATOAH/detkit
+    rev: v0.1.3
+    hooks:
+      - id: detkit-test
+        args: [rules]   # path to your rules
+```
+
+There's a `detkit-validate` hook too, for the lighter structural check.
+
 ## What it handles
 
 detkit runs your rules locally. No SIEM, no credentials, nothing leaves your machine or CI runner. I ran it against every rule in the SigmaHQ repo, and about 91% use only features it understands today: `contains`, `startswith`, `endswith`, `re`, value wildcards (`*` and `?`), `|cidr`, keyword lists, and `X of` / `all of` conditions.

{detkit_cli-0.1.3 → detkit_cli-0.1.5}/README.md

@@ -1,6 +1,6 @@
 # detkit
 
-[![CI](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml/badge.svg)](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml) [![PyPI](https://img.shields.io/pypi/v/detkit-cli)](https://pypi.org/project/detkit-cli/) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/ELSATOAH/detkit/blob/main/LICENSE)
+[![CI](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml/badge.svg)](https://github.com/ELSATOAH/detkit/actions/workflows/ci.yml) [![PyPI](https://img.shields.io/pypi/v/detkit-cli)](https://pypi.org/project/detkit-cli/) [![Python](https://img.shields.io/pypi/pyversions/detkit-cli)](https://pypi.org/project/detkit-cli/) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/ELSATOAH/detkit/blob/main/LICENSE)
 
 Unit tests for your Sigma detection rules. Write a rule, add a couple of example log events, and detkit tells you whether it fires on the ones that should trip it and stays quiet on the ones that shouldn't. Wire it into CI and a broken detection fails the pull request instead of failing silently in production.
 
@@ -68,6 +68,22 @@ jobs:
           path: rules
 ```
 
+## pre-commit
+
+Prefer to catch it before the commit lands? Add detkit to your [pre-commit](https://pre-commit.com) config:
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/ELSATOAH/detkit
+    rev: v0.1.3
+    hooks:
+      - id: detkit-test
+        args: [rules]   # path to your rules
+```
+
+There's a `detkit-validate` hook too, for the lighter structural check.
+
 ## What it handles
 
 detkit runs your rules locally. No SIEM, no credentials, nothing leaves your machine or CI runner. I ran it against every rule in the SigmaHQ repo, and about 91% use only features it understands today: `contains`, `startswith`, `endswith`, `re`, value wildcards (`*` and `?`), `|cidr`, keyword lists, and `X of` / `all of` conditions.