pySigma-backend-sqlite 1.1.1__tar.gz → 1.1.2__tar.gz

{pysigma_backend_sqlite-1.1.1 → pysigma_backend_sqlite-1.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pySigma-backend-sqlite
-Version: 1.1.1
+Version: 1.1.2
 Summary: pySigma sqlite backend
 License-Expression: LGPL-3.0-only
 License-File: LICENSE
@@ -12,7 +12,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
-Requires-Dist: pysigma (>=1.0.2,<=1.1.0)
+Requires-Dist: pysigma (>=1.0.2,<=2.0)
 Project-URL: Repository, https://github.com/SigmaHQ/pySigma-backend-sqlite
 Description-Content-Type: text/markdown
 
@@ -126,17 +126,18 @@ from sigma.backends.sqlite import sqlite
 from sigma.pipelines.sysmon import sysmon_pipeline
 from sigma.pipelines.windows import windows_logsource_pipeline
 
-from sigma.processing.resolver import ProcessingPipelineResolver
-
-# Create the pipeline resolver
-piperesolver = ProcessingPipelineResolver()
-# Add pipelines
-piperesolver.add_pipeline_class(sysmon_pipeline()) # Syssmon  
-piperesolver.add_pipeline_class(windows_logsource_pipeline()) # Windows
-# Create a combined pipeline
-combined_pipeline = piperesolver.resolve(piperesolver.pipelines)
-# Instantiate backend using the combined pipeline
+# Combine pipelines to map both Channel and EventID:
+# 1. sysmon_pipeline: maps category (e.g., process_creation) -> EventID (e.g., 1)
+#                     and changes logsource to service=sysmon
+# 2. windows_logsource_pipeline: maps service=sysmon -> Channel
+#
+# For process_creation/windows, this produces:
+#   Channel='Microsoft-Windows-Sysmon/Operational' AND EventID=1
+combined_pipeline = sysmon_pipeline() + windows_logsource_pipeline()
 sqlite_backend = sqlite.sqliteBackend(combined_pipeline)
+# Set the table name for the generated SQL queries
+sqlite_backend.table = "logs"
+
 
 rule = SigmaCollection.from_yaml(
 r"""

{pysigma_backend_sqlite-1.1.1 → pysigma_backend_sqlite-1.1.2}/README.md

@@ -108,17 +108,18 @@ from sigma.backends.sqlite import sqlite
 from sigma.pipelines.sysmon import sysmon_pipeline
 from sigma.pipelines.windows import windows_logsource_pipeline
 
-from sigma.processing.resolver import ProcessingPipelineResolver
-
-# Create the pipeline resolver
-piperesolver = ProcessingPipelineResolver()
-# Add pipelines
-piperesolver.add_pipeline_class(sysmon_pipeline()) # Syssmon  
-piperesolver.add_pipeline_class(windows_logsource_pipeline()) # Windows
-# Create a combined pipeline
-combined_pipeline = piperesolver.resolve(piperesolver.pipelines)
-# Instantiate backend using the combined pipeline
+# Combine pipelines to map both Channel and EventID:
+# 1. sysmon_pipeline: maps category (e.g., process_creation) -> EventID (e.g., 1)
+#                     and changes logsource to service=sysmon
+# 2. windows_logsource_pipeline: maps service=sysmon -> Channel
+#
+# For process_creation/windows, this produces:
+#   Channel='Microsoft-Windows-Sysmon/Operational' AND EventID=1
+combined_pipeline = sysmon_pipeline() + windows_logsource_pipeline()
 sqlite_backend = sqlite.sqliteBackend(combined_pipeline)
+# Set the table name for the generated SQL queries
+sqlite_backend.table = "logs"
+
 
 rule = SigmaCollection.from_yaml(
 r"""

{pysigma_backend_sqlite-1.1.1 → pysigma_backend_sqlite-1.1.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pySigma-backend-sqlite"
-version = "1.1.1"
+version = "1.1.2"
 description = "pySigma sqlite backend"
 readme = "README.md"
 authors = [
@@ -15,7 +15,7 @@ packages = [
 
 [tool.poetry.dependencies]
 python = "^3.10"
-pysigma = ">=1.0.2,<=1.1.0"
+pysigma = ">=1.0.2,<=2.0"
 
 [tool.poetry.group.dev.dependencies]
 black = "^24.1"

{pysigma_backend_sqlite-1.1.1 → pysigma_backend_sqlite-1.1.2}/sigma/backends/sqlite/sqlite.py

@@ -623,14 +623,69 @@ class sqliteBackend(TextQueryBackend):
 
         return sqlite_query
 
+    def _extract_field_values_from_rule(
+        self, rule: SigmaRule, field_name: str
+    ) -> List[Any]:
+        """
+        Extract all values for a given field name from a rule's detection section.
+        Returns a list of unique values found for the specified field.
+        """
+        from sigma.rule import SigmaDetectionItem
+        from sigma.types import SigmaString, SigmaNumber
+
+        values = set()
+        field_name_lower = field_name.lower()
+
+        # Iterate through all detection groups (sel, filter, etc.)
+        for detection_name, detection in rule.detection.detections.items():
+            # Each detection has detection_items
+            self._extract_values_from_detection(detection, field_name_lower, values)
+
+        return sorted(list(values), key=lambda x: str(x))
+
+    def _extract_values_from_detection(
+        self, detection, field_name_lower: str, values: set
+    ) -> None:
+        """
+        Recursively extract values from a detection for a given field name.
+        """
+        from sigma.rule import SigmaDetectionItem
+        from sigma.types import SigmaString, SigmaNumber
+
+        # Check if detection has detection_items attribute
+        if hasattr(detection, 'detection_items'):
+            for item in detection.detection_items:
+                self._extract_values_from_detection(item, field_name_lower, values)
+
+        # Check if this is a SigmaDetectionItem with field and value
+        if hasattr(detection, 'field') and hasattr(detection, 'value'):
+            # Check if the field matches (case-insensitive)
+            if detection.field and detection.field.lower() == field_name_lower:
+                # Extract the values
+                for value in detection.value:
+                    # Handle different value types
+                    if isinstance(value, SigmaNumber):
+                        values.add(value.number)
+                    elif isinstance(value, SigmaString):
+                        # SigmaString - convert to plain string
+                        values.add(str(value))
+                    else:
+                        values.add(str(value))
+
     def finalize_query_zircolite(
         self, rule: Union[SigmaRule, SigmaCorrelationRule], query: str, index: int, state: ConversionState
     ) -> Any:
         # For correlation rules, use the query as-is (already formatted)
         if isinstance(rule, SigmaCorrelationRule):
             sqlite_query = query
+            # Correlation rules don't have detection items in the same way
+            channels = []
+            event_ids = []
         else:
             sqlite_query = f"SELECT * FROM logs WHERE {query}"
+            # Extract channels and event IDs from the rule's detection
+            channels = self._extract_field_values_from_rule(rule, "Channel")
+            event_ids = self._extract_field_values_from_rule(rule, "EventID")
 
         rule_as_dict = rule.to_dict()
 
@@ -651,6 +706,8 @@ class sqliteBackend(TextQueryBackend):
             "level": rule_as_dict["level"] if "level" in rule_as_dict else "",
             "rule": [sqlite_query],
             "filename": "",
+            "channel": channels,
+            "eventid": event_ids,
         }
         return zircolite_rule