pySigma-backend-sqlite 1.1.3__tar.gz → 1.2.0__tar.gz

{pysigma_backend_sqlite-1.1.3 → pysigma_backend_sqlite-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pySigma-backend-sqlite
-Version: 1.1.3
+Version: 1.2.0
 Summary: pySigma sqlite backend
 License-Expression: LGPL-3.0-only
 License-File: LICENSE
@@ -12,7 +12,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
-Requires-Dist: pysigma (>=1.0.2,<=2.0)
+Requires-Dist: pysigma (>=1,<2)
 Project-URL: Repository, https://github.com/SigmaHQ/pySigma-backend-sqlite
 Description-Content-Type: text/markdown
 
@@ -35,6 +35,11 @@ This backend is currently maintained by:
 
 * [wagga](https://github.com/wagga40/)
 
+## Requirements
+
+* Python 3.10 or later
+* [pySigma](https://github.com/SigmaHQ/pySigma) `>= 1.0.2, < 2.0` (tested with 1.4.0)
+
 ## Supported Features
 
 ### Sigma Modifiers
@@ -51,8 +56,11 @@ This backend is currently maintained by:
 | `fieldref` | Compare two fields | `field1=field2` or with `LIKE` for startswith/endswith/contains |
 | `exists` | Field existence check | `field = field` |
 | `gt`, `gte`, `lt`, `lte` | Numeric comparisons | `>`, `>=`, `<`, `<=` |
+| `neq` | Not equal | `NOT field='value'` |
 | `hour`, `minute`, `day`, `week`, `month`, `year` | Timestamp part extraction | `strftime()` |
 
+> **Note on `cased`:** SQLite's `GLOB` is a native 2-argument operator with no `ESCAPE` clause, so queries are emitted as `field GLOB 'pattern'` and backslashes are kept literal (e.g. Windows paths match as-is). Because `GLOB` has no escape mechanism, a *literal* `*`, `?` or `[` inside a `cased` value is still interpreted as a glob metacharacter; escaping such literals (`[*]`) is not currently supported.
+
 ### Correlation Rules
 
 The backend supports Sigma correlation rules with the following types:
@@ -65,6 +73,10 @@ The backend supports Sigma correlation rules with the following types:
 | `temporal_ordered` | Events occurring in a specific order within a timespan |
 | `value_sum` | Sum of field values |
 | `value_avg` | Average of field values |
+| `value_percentile` | Percentile of field values |
+| `value_median` | Median of field values |
+
+The following correlation types are **not supported**: `temporal_extended`, `temporal_ordered_extended`.
 
 Correlation rules support `group-by` for grouping results and `timespan` for temporal constraints.
 
@@ -120,9 +132,9 @@ poetry add pysigma-pipeline-windows
 
 ### Convert a rule
 
-```python 
+```python
 from sigma.collection import SigmaCollection
-from sigma.backends.sqlite import sqlite
+from sigma.backends.sqlite import sqliteBackend
 from sigma.pipelines.sysmon import sysmon_pipeline
 from sigma.pipelines.windows import windows_logsource_pipeline
 
@@ -134,7 +146,7 @@ from sigma.pipelines.windows import windows_logsource_pipeline
 # For process_creation/windows, this produces:
 #   Channel='Microsoft-Windows-Sysmon/Operational' AND EventID=1
 combined_pipeline = sysmon_pipeline() + windows_logsource_pipeline()
-sqlite_backend = sqlite.sqliteBackend(combined_pipeline)
+sqlite_backend = sqliteBackend(combined_pipeline)
 # Set the table name for the generated SQL queries
 sqlite_backend.table = "logs"
 

{pysigma_backend_sqlite-1.1.3 → pysigma_backend_sqlite-1.2.0}/README.md

@@ -17,6 +17,11 @@ This backend is currently maintained by:
 
 * [wagga](https://github.com/wagga40/)
 
+## Requirements
+
+* Python 3.10 or later
+* [pySigma](https://github.com/SigmaHQ/pySigma) `>= 1.0.2, < 2.0` (tested with 1.4.0)
+
 ## Supported Features
 
 ### Sigma Modifiers
@@ -33,8 +38,11 @@ This backend is currently maintained by:
 | `fieldref` | Compare two fields | `field1=field2` or with `LIKE` for startswith/endswith/contains |
 | `exists` | Field existence check | `field = field` |
 | `gt`, `gte`, `lt`, `lte` | Numeric comparisons | `>`, `>=`, `<`, `<=` |
+| `neq` | Not equal | `NOT field='value'` |
 | `hour`, `minute`, `day`, `week`, `month`, `year` | Timestamp part extraction | `strftime()` |
 
+> **Note on `cased`:** SQLite's `GLOB` is a native 2-argument operator with no `ESCAPE` clause, so queries are emitted as `field GLOB 'pattern'` and backslashes are kept literal (e.g. Windows paths match as-is). Because `GLOB` has no escape mechanism, a *literal* `*`, `?` or `[` inside a `cased` value is still interpreted as a glob metacharacter; escaping such literals (`[*]`) is not currently supported.
+
 ### Correlation Rules
 
 The backend supports Sigma correlation rules with the following types:
@@ -47,6 +55,10 @@ The backend supports Sigma correlation rules with the following types:
 | `temporal_ordered` | Events occurring in a specific order within a timespan |
 | `value_sum` | Sum of field values |
 | `value_avg` | Average of field values |
+| `value_percentile` | Percentile of field values |
+| `value_median` | Median of field values |
+
+The following correlation types are **not supported**: `temporal_extended`, `temporal_ordered_extended`.
 
 Correlation rules support `group-by` for grouping results and `timespan` for temporal constraints.
 
@@ -102,9 +114,9 @@ poetry add pysigma-pipeline-windows
 
 ### Convert a rule
 
-```python 
+```python
 from sigma.collection import SigmaCollection
-from sigma.backends.sqlite import sqlite
+from sigma.backends.sqlite import sqliteBackend
 from sigma.pipelines.sysmon import sysmon_pipeline
 from sigma.pipelines.windows import windows_logsource_pipeline
 
@@ -116,7 +128,7 @@ from sigma.pipelines.windows import windows_logsource_pipeline
 # For process_creation/windows, this produces:
 #   Channel='Microsoft-Windows-Sysmon/Operational' AND EventID=1
 combined_pipeline = sysmon_pipeline() + windows_logsource_pipeline()
-sqlite_backend = sqlite.sqliteBackend(combined_pipeline)
+sqlite_backend = sqliteBackend(combined_pipeline)
 # Set the table name for the generated SQL queries
 sqlite_backend.table = "logs"
 

{pysigma_backend_sqlite-1.1.3 → pysigma_backend_sqlite-1.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pySigma-backend-sqlite"
-version = "1.1.3"
+version = "1.2.0"
 description = "pySigma sqlite backend"
 readme = "README.md"
 authors = [
@@ -15,7 +15,7 @@ packages = [
 
 [tool.poetry.dependencies]
 python = "^3.10"
-pysigma = ">=1.0.2,<=2.0"
+pysigma = "^1"
 
 [tool.poetry.group.dev.dependencies]
 black = "^24.1"

{pysigma_backend_sqlite-1.1.3 → pysigma_backend_sqlite-1.2.0}/sigma/backends/sqlite/sqlite.py

@@ -144,7 +144,12 @@ class sqliteBackend(TextQueryBackend):
     # remove it from re_flags or don't define it to ensure proper error handling in case of appearance.
     # re_flags : Dict[SigmaRegularExpressionFlag, str] = {}
 
-    case_sensitive_match_expression: ClassVar[str] = "{field} GLOB {value} ESCAPE '\\'"
+    # SQLite's GLOB is a 2-argument operator with no ESCAPE clause (unlike LIKE);
+    # emitting "ESCAPE '\'" triggers "wrong number of arguments to function GLOB()" at runtime.
+    # Wildcards for |startswith/|endswith/|contains|cased are embedded in the value via
+    # case_sensitive_match_expression; dedicated startswith/endswith/contains templates
+    # would place GLOB metacharacters outside the quoted literal and produce invalid SQL.
+    case_sensitive_match_expression: ClassVar[str] = "{field} GLOB {value}"
 
     # Numeric comparison operators
     compare_op_expression: ClassVar[str] = (
@@ -449,7 +454,9 @@ class sqliteBackend(TextQueryBackend):
                 escape_char=self.escape_char,
                 wildcard_multi=self.wildcard_glob,
                 wildcard_single=self.wildcard_glob_single,
-                add_escaped=self.add_escaped,
+                # GLOB has no ESCAPE clause, so backslashes must stay literal.
+                # Escaping them (as LIKE requires) would break matches like Windows paths.
+                add_escaped="",
                 filter_chars=self.filter_chars,
             )
         else:
@@ -540,7 +547,7 @@ class sqliteBackend(TextQueryBackend):
     def convert_condition_field_eq_val_str_case_sensitive(
         self, cond: ConditionFieldEqualsValueExpression, state: ConversionState
     ) -> Union[str, DeferredQueryExpression]:
-        """Conversion of case-sensitive field = string value expressions"""
+        """Case-sensitive matching via GLOB with literal backslashes (no ESCAPE clause)."""
         try:
             if (  # Check conditions for usage of 'startswith' operator
                 self.case_sensitive_startswith_expression