kodon 0.0.1__py3-none-any.whl

kodon/__init__.py

@@ -0,0 +1,30 @@
+"""kodon: detection-as-code. Sigma rules with tests, compiled to Splunk SPL,
+Sentinel KQL and DuckDB SQL, replay-tested on synthetic telemetry.
+
+Public consumption contract (what a downstream pipeline imports):
+
+    from kodon import load_rules, compile_rule, replay, coverage_report
+    from kodon.contracts import RuleMeta, DetectionHit, CoverageReport
+"""
+
+from kodon.compile import TARGETS, compile_all, compile_rule
+from kodon.contracts import CoverageReport, DetectionHit, RuleMeta
+from kodon.coverage import coverage_report
+from kodon.loader import LoadedRule, load_rules
+from kodon.replay import replay
+
+__version__ = "0.0.1"
+
+__all__ = [
+    "TARGETS",
+    "CoverageReport",
+    "DetectionHit",
+    "LoadedRule",
+    "RuleMeta",
+    "__version__",
+    "compile_all",
+    "compile_rule",
+    "coverage_report",
+    "load_rules",
+    "replay",
+]

kodon/cli.py

@@ -0,0 +1,133 @@
+"""kodon validate | compile --target | test | coverage | demo"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+import tempfile
+from pathlib import Path
+
+from kodon.compile import TARGETS, compile_all, compile_rule
+from kodon.coverage import coverage_report, render_matrix
+from kodon.loader import LoadedRule, RuleContractError, load_rules
+from kodon.replay import replay_samples
+from kodon.synth import write_samples
+
+
+def _samples_dir() -> Path:
+    from kodon.loader import repo_root
+
+    root = repo_root()
+    if root is not None and (root / "tests" / "samples").is_dir():
+        return root / "tests" / "samples"
+    raise FileNotFoundError("tests/samples not found; run `kodon demo` or scripts/gen_samples.py")
+
+
+def _load() -> list[LoadedRule]:
+    try:
+        return load_rules()
+    except RuleContractError as exc:
+        print(f"CONTRACT VIOLATION: {exc}", file=sys.stderr)
+        sys.exit(2)
+
+
+def cmd_validate(args: argparse.Namespace) -> int:
+    rules = _load()
+    print(f"{'rule_id':<42} {'kind':<12} {'level':<8} techniques")
+    for lr in rules:
+        m = lr.meta
+        print(f"{m.rule_id:<42} {m.kind:<12} {m.level:<8} {', '.join(m.techniques)}")
+    print(f"\n{len(rules)} rules valid; metadata contract satisfied")
+    return 0
+
+
+def cmd_compile(args: argparse.Namespace) -> int:
+    rules = _load()
+    if args.rule:
+        rules = [lr for lr in rules if lr.rule_id == args.rule]
+        if not rules:
+            print(f"no rule named {args.rule}", file=sys.stderr)
+            return 2
+    for lr in rules:
+        print(f"# {lr.rule_id} [{args.target}]")
+        print(compile_rule(lr, args.target))
+        print()
+    return 0
+
+
+def _replay_table(rules: list[LoadedRule], samples: Path) -> bool:
+    ok = True
+    print(f"{'rule_id':<42} {'hit rows':>8} {'matched':>8} {'miss rows':>9} {'matched':>8}  result")
+    for lr in rules:
+        r = replay_samples(lr, samples)
+        ok = ok and r.passed
+        print(
+            f"{r.rule_id:<42} {r.hit_rows:>8} {r.hit_matches:>8} {r.miss_rows:>9} {r.miss_matches:>8}  "
+            f"{'PASS' if r.passed else 'FAIL'}"
+        )
+    return ok
+
+
+def cmd_test(args: argparse.Namespace) -> int:
+    rules = _load()
+    ok = _replay_table(rules, Path(args.samples) if args.samples else _samples_dir())
+    print("\nreplay: PASS" if ok else "\nreplay: FAIL")
+    return 0 if ok else 1
+
+
+def cmd_coverage(args: argparse.Namespace) -> int:
+    rules = _load()
+    report = coverage_report([lr.meta for lr in rules])
+    if args.json:
+        print(report.model_dump_json(indent=2))
+    else:
+        print(render_matrix(report))
+    return 0
+
+
+def cmd_demo(args: argparse.Namespace) -> int:
+    print("kodon demo: generate -> validate -> compile -> replay -> coverage (no model, no network)\n")
+    rules = _load()
+    with tempfile.TemporaryDirectory(prefix="kodon-samples-") as tmp:
+        samples = Path(tmp)
+        counts = write_samples(samples)
+        print(f"[1/5] generated seeded samples for {len(counts)} rules "
+              f"({sum(h for h, _ in counts.values())} must-hit rows, {sum(m for _, m in counts.values())} must-miss rows)")
+        print(f"[2/5] validated {len(rules)} rules against the metadata contract")
+        for target in TARGETS:
+            compile_all(rules, target)
+        print(f"[3/5] compiled {len(rules)} rules to {', '.join(TARGETS)}")
+        example = next(lr for lr in rules if lr.correlation is not None)
+        print(f"\n      example, {example.rule_id}:")
+        for target in TARGETS:
+            body = compile_rule(example, target).strip().replace("\n\n", "\n")
+            print(f"      --- {target}\n" + "\n".join("      " + line for line in body.splitlines()))
+        print("\n[4/5] replay: compiled DuckDB SQL over the samples")
+        ok = _replay_table(rules, samples)
+    print("\n[5/5] coverage")
+    print(render_matrix(coverage_report([lr.meta for lr in rules])))
+    print("demo: PASS" if ok else "demo: FAIL")
+    return 0 if ok else 1
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(prog="kodon", description=__doc__)
+    sub = parser.add_subparsers(dest="command", required=True)
+    sub.add_parser("validate", help="load every rule and enforce the metadata contract").set_defaults(fn=cmd_validate)
+    c = sub.add_parser("compile", help="print compiled queries")
+    c.add_argument("--target", choices=TARGETS, required=True)
+    c.add_argument("--rule", help="only this rule id")
+    c.set_defaults(fn=cmd_compile)
+    t = sub.add_parser("test", help="replay every rule's hit/miss samples")
+    t.add_argument("--samples", help="samples directory (default: tests/samples)")
+    t.set_defaults(fn=cmd_test)
+    cv = sub.add_parser("coverage", help="ATT&CK coverage matrix and gaps")
+    cv.add_argument("--json", action="store_true")
+    cv.set_defaults(fn=cmd_coverage)
+    sub.add_parser("demo", help="generate, validate, compile, replay, coverage").set_defaults(fn=cmd_demo)
+    args = parser.parse_args(argv)
+    return args.fn(args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

kodon/compile.py

@@ -0,0 +1,115 @@
+"""compile(rule, target) -> query string.
+
+Targets:
+  splunk  pySigma Splunk backend, no field mapping (Sigma taxonomy field names)
+  kql     pySigma Kusto backend + pipelines/kql_tables.yml (table per logsource)
+  duckdb  kodon's DuckDB backend + pipelines/synthetic_canonical.yml
+
+Field names in the splunk and kql output are the Sigma taxonomy names. Mapping
+them onto a deployment's actual columns is a processing pipeline the deployment
+owns and passes in as `pipeline=`; that is the seam a downstream consumer fills.
+"""
+
+from __future__ import annotations
+
+import copy
+from functools import cache
+
+from sigma.backends.splunk import SplunkBackend
+from sigma.collection import SigmaCollection
+from sigma.conversion.base import Backend
+from sigma.correlations import SigmaCorrelationRule
+from sigma.processing.pipeline import ProcessingPipeline
+from sigma.rule import SigmaRule
+
+from kodon.duckdb_backend import DuckDBBackend
+from kodon.kusto_backend import KodonKustoBackend
+from kodon.loader import LoadedRule, resource_dir
+
+TARGETS = ("splunk", "kql", "duckdb")
+DEFAULT_PIPELINE_FILE = {"kql": "kql_tables.yml", "duckdb": "synthetic_canonical.yml"}
+KQL_TIMESTAMP = "TimeGenerated"
+KQL_UNITS = {"s": "s", "m": "m", "h": "h", "d": "d"}
+KQL_OPS = {"LT": "<", "LTE": "<=", "GT": ">", "GTE": ">=", "EQ": "==", "NEQ": "!="}
+
+
+@cache
+def _pipeline_from_file(path: str) -> ProcessingPipeline:
+    with open(path, encoding="utf-8") as fh:
+        return ProcessingPipeline.from_yaml(fh.read())
+
+
+def default_pipeline(target: str) -> ProcessingPipeline | None:
+    name = DEFAULT_PIPELINE_FILE.get(target)
+    if name is None:
+        return None
+    return _pipeline_from_file(str(resource_dir("pipelines") / name))
+
+
+def _backend(target: str, pipeline: ProcessingPipeline | None) -> Backend:
+    if target == "splunk":
+        return SplunkBackend(pipeline)
+    if target == "kql":
+        return KodonKustoBackend(pipeline)
+    if target == "duckdb":
+        return DuckDBBackend(pipeline)
+    raise ValueError(f"unknown target {target!r}; expected one of {TARGETS}")
+
+
+def _fresh(loaded: LoadedRule) -> tuple[SigmaCollection, SigmaRule, SigmaCorrelationRule | None]:
+    """pySigma pipelines rewrite field names on the rule object itself, so
+    each compilation works on its own deep copy of the parsed collection."""
+    collection = copy.deepcopy(loaded.collection)
+    rule = next(r for r in collection.rules if isinstance(r, SigmaRule))
+    corr = next((r for r in collection.rules if isinstance(r, SigmaCorrelationRule)), None)
+    return collection, rule, corr
+
+
+def _kql(backend: KodonKustoBackend, rule: SigmaRule, corr: SigmaCorrelationRule | None) -> str:
+    """The Kusto backend does not emit correlation rules (pysigma-backend-kusto
+    1.0), so kodon appends the summarize clause itself: the same fixed-window
+    aggregation the Splunk and DuckDB outputs use."""
+    rule._output = True  # a rule referenced by a correlation is marked non-output
+    body = backend.convert_rule(rule)[0]
+    pipeline = backend.last_processing_pipeline
+    table = pipeline.state.get("query_table")
+    query = f"{table}\n| where {body}" if table else f"search {body}"
+    if corr is None:
+        return query
+    pipeline.apply(corr)  # maps the group-by and value-count fields like the rule's own
+    span = corr.timespan
+    kql_span = f"{span.count * 7}d" if span.unit == "w" else f"{span.count}{KQL_UNITS[span.unit]}"
+    fields = ", ".join(backend.escape_and_quote_field(f) for f in corr.group_by or [])
+    if corr.type.name.lower() == "event_count":
+        agg, alias = "event_count = count()", "event_count"
+    else:
+        field = backend.escape_and_quote_field(str(corr.condition.fieldref))
+        agg, alias = f"value_count = dcount({field})", "value_count"
+    op = KQL_OPS[corr.condition.op.name]
+    return (
+        f"{query}\n| summarize {agg} by bin({KQL_TIMESTAMP}, {kql_span}), {fields}"
+        f"\n| where {alias} {op} {corr.condition.count}"
+    )
+
+
+def compile_rule(
+    loaded: LoadedRule, target: str, pipeline: ProcessingPipeline | None = None
+) -> str:
+    """Compile one loaded rule (its correlation, if it has one) for a target."""
+    if target not in TARGETS:
+        raise ValueError(f"unknown target {target!r}; expected one of {TARGETS}")
+    pipeline = pipeline if pipeline is not None else default_pipeline(target)
+    backend = _backend(target, pipeline)
+    collection, rule, corr = _fresh(loaded)
+    if target == "kql":
+        return _kql(backend, rule, corr)  # type: ignore[arg-type]
+    queries = backend.convert(collection)
+    if len(queries) != 1:
+        raise RuntimeError(f"{loaded.rule_id}: expected one query for {target}, got {len(queries)}")
+    return queries[0]
+
+
+def compile_all(
+    rules: list[LoadedRule], target: str, pipeline: ProcessingPipeline | None = None
+) -> dict[str, str]:
+    return {lr.rule_id: compile_rule(lr, target, pipeline) for lr in rules}

kodon/contracts.py

@@ -0,0 +1,100 @@
+"""The public consumption contract: what a downstream consumer receives.
+
+Everything a consumer needs is a plain pydantic model. pySigma objects never
+cross this boundary, so a consumer does not need to know pySigma to use the
+hits, and the models can be serialised straight into a finding store.
+"""
+
+from __future__ import annotations
+
+from datetime import date
+from typing import Any, Literal
+
+from pydantic import BaseModel, Field, field_validator
+
+Status = Literal["experimental", "test", "stable", "deprecated", "unsupported"]
+Level = Literal["informational", "low", "medium", "high", "critical"]
+RuleKind = Literal["event", "correlation"]
+
+
+class DetectionHealth(BaseModel):
+    """When the rule was added, when a human last looked at it, and who owns it."""
+
+    added: date
+    last_reviewed: date
+    owner: str
+
+    @field_validator("last_reviewed")
+    @classmethod
+    def _reviewed_after_added(cls, v: date, info: Any) -> date:
+        added = info.data.get("added")
+        if added is not None and v < added:
+            raise ValueError("last_reviewed precedes added")
+        return v
+
+
+class RuleMeta(BaseModel):
+    """Metadata contract enforced by the loader for every rule file."""
+
+    rule_id: str = Field(description="File stem; stable, human-readable identifier")
+    sigma_id: str = Field(description="Sigma id: uuid5 of the rule_id, 32 hex chars")
+    title: str
+    status: Status
+    level: Level
+    kind: RuleKind
+    logsource: dict[str, str]
+    techniques: list[str] = Field(description="ATT&CK technique ids, e.g. T1127.001")
+    tactics: list[str] = Field(description="ATT&CK tactic slugs, e.g. defense-evasion")
+    data_sources: list[str]
+    false_positives: list[str]
+    do_not_alert_when: str = Field(
+        description="The judgment call: when this rule should stay a hunt, not an alert"
+    )
+    detection_health: DetectionHealth
+    references: list[str] = Field(default_factory=list)
+    path: str
+
+
+class DetectionHit(BaseModel):
+    """One row that a compiled rule matched. For an event rule this is the
+    event; for a correlation rule it is one aggregated group (bucket,
+    group-by values, count)."""
+
+    rule_id: str
+    sigma_id: str
+    title: str
+    level: Level
+    kind: RuleKind
+    techniques: list[str]
+    tactics: list[str]
+    matched: dict[str, Any]
+
+
+class TechniqueRef(BaseModel):
+    technique: str
+    name: str
+    tactics: list[str]
+
+
+class CoverageReport(BaseModel):
+    """ATT&CK coverage of the rule set against a declared scope.
+
+    Gaps are computed against the scope, not against all of ATT&CK: a matrix
+    that is red everywhere says nothing about what the rule set was meant to
+    cover.
+    """
+
+    scope: list[TechniqueRef]
+    by_technique: dict[str, list[str]] = Field(description="technique id -> rule ids")
+    by_tactic: dict[str, list[str]] = Field(description="tactic -> rule ids")
+    out_of_scope: dict[str, list[str]] = Field(
+        description="techniques tagged by a rule but absent from the scope"
+    )
+
+    @property
+    def gaps(self) -> list[TechniqueRef]:
+        return [t for t in self.scope if not self.by_technique.get(t.technique)]
+
+    @property
+    def covered(self) -> list[TechniqueRef]:
+        return [t for t in self.scope if self.by_technique.get(t.technique)]

kodon/coverage/attack_scope.yml

@@ -0,0 +1,30 @@
+# The ATT&CK techniques this rule set is meant to cover. Coverage and gaps are
+# computed against this list, not against the whole matrix: a matrix that is
+# red everywhere says nothing about what the rule set was meant to cover.
+# Technique names are from MITRE ATT&CK (https://attack.mitre.org), used under
+# its terms; tactics listed are the ones this rule set watches for.
+techniques:
+  - {technique: T1078.004, name: "Valid Accounts: Cloud Accounts", tactics: [initial-access]}
+  - {technique: T1621, name: "Multi-Factor Authentication Request Generation", tactics: [credential-access]}
+  - {technique: T1110.003, name: "Brute Force: Password Spraying", tactics: [credential-access]}
+  - {technique: T1566.001, name: "Phishing: Spearphishing Attachment", tactics: [initial-access]}
+  - {technique: T1204.002, name: "User Execution: Malicious File", tactics: [execution]}
+  - {technique: T1059.001, name: "Command and Scripting Interpreter: PowerShell", tactics: [execution]}
+  - {technique: T1047, name: "Windows Management Instrumentation", tactics: [execution]}
+  - {technique: T1053.005, name: "Scheduled Task/Job: Scheduled Task", tactics: [persistence]}
+  - {technique: T1098, name: "Account Manipulation", tactics: [persistence]}
+  - {technique: T1136.003, name: "Create Account: Cloud Account", tactics: [persistence]}
+  - {technique: T1127.001, name: "Trusted Developer Utilities Proxy Execution: MSBuild", tactics: [defense-evasion]}
+  - {technique: T1036.005, name: "Masquerading: Match Legitimate Name or Location", tactics: [defense-evasion]}
+  - {technique: T1070.001, name: "Indicator Removal: Clear Windows Event Logs", tactics: [defense-evasion]}
+  - {technique: T1003.001, name: "OS Credential Dumping: LSASS Memory", tactics: [credential-access]}
+  - {technique: T1558.003, name: "Steal or Forge Kerberos Tickets: Kerberoasting", tactics: [credential-access]}
+  - {technique: T1528, name: "Steal Application Access Token", tactics: [credential-access]}
+  - {technique: T1482, name: "Domain Trust Discovery", tactics: [discovery]}
+  - {technique: T1021.006, name: "Remote Services: Windows Remote Management", tactics: [lateral-movement]}
+  - {technique: T1114.003, name: "Email Collection: Email Forwarding Rule", tactics: [collection]}
+  - {technique: T1071.001, name: "Application Layer Protocol: Web Protocols", tactics: [command-and-control]}
+  - {technique: T1571, name: "Non-Standard Port", tactics: [command-and-control]}
+  - {technique: T1105, name: "Ingress Tool Transfer", tactics: [command-and-control]}
+  - {technique: T1048.003, name: "Exfiltration Over Unencrypted Non-C2 Protocol", tactics: [exfiltration]}
+  - {technique: T1567.002, name: "Exfiltration to Cloud Storage", tactics: [exfiltration]}

kodon/coverage.py

@@ -0,0 +1,70 @@
+"""ATT&CK coverage matrix and gaps, computed against a declared scope."""
+
+from __future__ import annotations
+
+from collections import defaultdict
+from pathlib import Path
+
+import yaml
+
+from kodon.contracts import CoverageReport, RuleMeta, TechniqueRef
+from kodon.loader import resource_dir
+
+SCOPE_FILE = "attack_scope.yml"
+
+
+def load_scope(path: Path | None = None) -> list[TechniqueRef]:
+    p = path or resource_dir("coverage") / SCOPE_FILE
+    data = yaml.safe_load(p.read_text(encoding="utf-8"))
+    return [TechniqueRef.model_validate(t) for t in data["techniques"]]
+
+
+def coverage_report(metas: list[RuleMeta], scope: list[TechniqueRef] | None = None) -> CoverageReport:
+    scope = scope if scope is not None else load_scope()
+    in_scope = {t.technique for t in scope}
+    by_technique: dict[str, list[str]] = defaultdict(list)
+    by_tactic: dict[str, list[str]] = defaultdict(list)
+    out_of_scope: dict[str, list[str]] = defaultdict(list)
+    for m in metas:
+        for t in m.techniques:
+            by_technique[t].append(m.rule_id)
+            if t not in in_scope:
+                out_of_scope[t].append(m.rule_id)
+        for tac in m.tactics:
+            by_tactic[tac].append(m.rule_id)
+    return CoverageReport(
+        scope=scope,
+        by_technique=dict(by_technique),
+        by_tactic=dict(by_tactic),
+        out_of_scope=dict(out_of_scope),
+    )
+
+
+def render_matrix(report: CoverageReport) -> str:
+    """Tactic-major text matrix: one line per in-scope technique."""
+    tactics: list[str] = []
+    for t in report.scope:
+        for tac in t.tactics:
+            if tac not in tactics:
+                tactics.append(tac)
+    lines = [
+        f"ATT&CK coverage: {len(report.covered)}/{len(report.scope)} in-scope techniques "
+        f"have at least one rule; {len(report.gaps)} gaps",
+        "",
+    ]
+    for tac in tactics:
+        lines.append(f"[{tac}]")
+        for t in report.scope:
+            if tac not in t.tactics:
+                continue
+            rules = report.by_technique.get(t.technique, [])
+            mark = "#" if rules else "."
+            who = ", ".join(rules) if rules else "GAP"
+            lines.append(f"  {mark} {t.technique:<10} {t.name:<44} {who}")
+        lines.append("")
+    if report.out_of_scope:
+        lines.append("tagged but outside the declared scope (add to coverage/attack_scope.yml):")
+        for t, rules in sorted(report.out_of_scope.items()):
+            lines.append(f"  ? {t:<10} {', '.join(rules)}")
+        lines.append("")
+    return "\n".join(lines)

kodon/duckdb_backend.py

@@ -0,0 +1,80 @@
+"""A thin DuckDB backend built on the maintained pySigma SQLite backend.
+
+Three things differ from SQLite and matter for correctness:
+
+* Sigma string matching is case-insensitive. SQLite's LIKE is; DuckDB's is
+  not, so every string match is emitted as ILIKE.
+* DuckDB has no REGEXP operator; regular expressions use regexp_matches().
+* The SQLite backend ignores a correlation's timespan. Here event_count and
+  value_count are bucketed with time_bucket() over the timestamp column, the
+  same fixed-window approximation Splunk's `bin _time span=` uses.
+"""
+
+from __future__ import annotations
+
+from typing import Any, ClassVar
+
+from sigma.backends.sqlite import sqliteBackend
+from sigma.correlations import SigmaCorrelationRule, SigmaCorrelationTypeLiteral
+from sigma.exceptions import SigmaConversionError
+
+DEFAULT_TABLE = "events"
+DEFAULT_TIMESTAMP = "ts"
+
+
+class DuckDBBackend(sqliteBackend):
+    name: ClassVar[str] = "DuckDB backend (kodon)"
+    formats: ClassVar[dict[str, str]] = {"default": "DuckDB SQL"}
+
+    eq_expression: ClassVar[str] = "{field} ILIKE {value} ESCAPE '\\'"
+    startswith_expression: ClassVar[str] = "{field} ILIKE '{value}%' ESCAPE '\\'"
+    endswith_expression: ClassVar[str] = "{field} ILIKE '%{value}' ESCAPE '\\'"
+    contains_expression: ClassVar[str] = "{field} ILIKE '%{value}%' ESCAPE '\\'"
+    wildcard_match_expression: ClassVar[str] = "{field} ILIKE '{value}' ESCAPE '\\'"
+    wildcard_match_str_expression: ClassVar[str] = "{field} ILIKE '{value}' ESCAPE '\\'"
+    re_expression: ClassVar[str] = "regexp_matches({field}, '{regex}')"
+    field_quote: ClassVar[str] = '"'
+    table = DEFAULT_TABLE
+    timestamp_field = DEFAULT_TIMESTAMP
+
+    def convert_condition_field_eq_val_str(self, cond: Any, state: Any) -> Any:
+        # SQLite's backend falls through to `field = value` for plain strings,
+        # which is case-sensitive in DuckDB. Route plain equality through ILIKE.
+        value = cond.value
+        if not value.contains_special():
+            return self.eq_expression.format(
+                field=self.escape_and_quote_field(cond.field),
+                value=self.convert_value_str(value, state),
+            )
+        return super().convert_condition_field_eq_val_str(cond, state)
+
+    def convert_correlation_rule_from_template(
+        self,
+        rule: SigmaCorrelationRule,
+        correlation_type: SigmaCorrelationTypeLiteral,
+        method: str,
+    ) -> list[str]:
+        if correlation_type not in ("event_count", "value_count"):
+            raise SigmaConversionError(
+                rule, rule.source, f"correlation type {correlation_type!r} not supported by kodon"
+            )
+        state = self.last_processing_pipeline.state
+        table = state.get("table", self.table)
+        ts = state.get("timestamp_field", self.timestamp_field)
+        search = self.convert_correlation_search(rule).replace("FROM logs", f"FROM {table}")
+        group_fields = [self.escape_and_quote_field(f) for f in rule.group_by or []]
+        seconds = self.convert_timespan(rule.timespan, method)
+        bucket = f"time_bucket(INTERVAL '{seconds} seconds', {self.escape_and_quote_field(ts)}) AS bucket"
+        if correlation_type == "event_count":
+            aggregate = "COUNT(*)"
+            alias = "event_count"
+        else:
+            aggregate = f"COUNT(DISTINCT {self.escape_and_quote_field(str(rule.condition.fieldref))})"
+            alias = "value_count"
+        op = self.correlation_condition_mapping[rule.condition.op]
+        select = ", ".join([bucket, *group_fields, f"{aggregate} AS {alias}"])
+        group = ", ".join(["1", *group_fields])
+        return [
+            f"SELECT {select} FROM ({search}) AS subquery "
+            f"GROUP BY {group} HAVING {aggregate} {op} {rule.condition.count}"
+        ]

kodon/kusto_backend.py

@@ -0,0 +1,42 @@
+"""Two small corrections on top of the pySigma Kusto backend.
+
+* A field name that is not a plain identifier (Sigma's dotted names such as
+  id.orig_h) is emitted in KQL bracket form, ['id.orig_h'].
+* A CIDR match quotes its field the same way (pySigma formats it raw).
+* `in~` is only used for string lists. KQL's in~ compares strings, so a
+  numeric list (ports, event ids) is emitted as an OR of == comparisons.
+"""
+
+from __future__ import annotations
+
+import copy
+import re
+from typing import Any, ClassVar
+
+from sigma.backends.kusto import KustoBackend
+from sigma.conditions import ConditionFieldEqualsValueExpression
+from sigma.types import SigmaString
+
+IDENTIFIER: re.Pattern[str] = re.compile(r"^\w+$")
+
+
+class KodonKustoBackend(KustoBackend):
+    name: ClassVar[str] = "Kusto backend (kodon)"
+
+    def escape_and_quote_field(self, field_name: str) -> str:
+        if IDENTIFIER.match(field_name) or field_name.startswith("['"):
+            return field_name  # plain identifier, or already bracketed by an earlier pass
+        return "['" + field_name.replace("'", "\\'") + "']"
+
+    def decide_convert_condition_as_in_expression(self, cond: Any, state: Any) -> bool:
+        if not super().decide_convert_condition_as_in_expression(cond, state):
+            return False
+        return all(
+            isinstance(arg, ConditionFieldEqualsValueExpression) and isinstance(arg.value, SigmaString)
+            for arg in cond.args
+        )
+
+    def convert_condition_field_eq_val_cidr(self, cond: Any, state: Any) -> Any:
+        quoted = copy.copy(cond)
+        quoted.field = self.escape_and_quote_field(cond.field)
+        return super().convert_condition_field_eq_val_cidr(quoted, state)