pySigma-backend-sqlite 1.2.0__tar.gz → 1.2.4__tar.gz

{pysigma_backend_sqlite-1.2.0 → pysigma_backend_sqlite-1.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pySigma-backend-sqlite
-Version: 1.2.0
+Version: 1.2.4
 Summary: pySigma sqlite backend
 License-Expression: LGPL-3.0-only
 License-File: LICENSE

{pysigma_backend_sqlite-1.2.0 → pysigma_backend_sqlite-1.2.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pySigma-backend-sqlite"
-version = "1.2.0"
+version = "1.2.4"
 description = "pySigma sqlite backend"
 readme = "README.md"
 authors = [

{pysigma_backend_sqlite-1.2.0 → pysigma_backend_sqlite-1.2.4}/sigma/backends/sqlite/sqlite.py

@@ -13,6 +13,7 @@ from sigma.conditions import (
 )
 from sigma.types import (
     SigmaCompareExpression,
+    SigmaRegularExpression,
     SigmaString,
     SpecialChars,
     SigmaCIDRExpression,
@@ -413,6 +414,12 @@ class sqliteBackend(TextQueryBackend):
 
         search = self.convert_correlation_search(rule)
 
+        # Correlation search templates hardcode "FROM logs"; honor a "table" state
+        # key set by a setState transformation, matching finalize_query_default.
+        table = self.last_processing_pipeline.state.get("table")
+        if table is not None:
+            search = search.replace("FROM logs", f"FROM {table}")
+
         # Determine select_fields based on whether GROUP BY is used
         if rule.group_by:
             # When GROUP BY is used, only select the grouped fields
@@ -477,6 +484,12 @@ class sqliteBackend(TextQueryBackend):
         else:
             return converted
 
+    def convert_value_re(
+        self, r: SigmaRegularExpression, state: ConversionState
+    ) -> str:
+        # Doubling single quotes is mandatory: the regex is embedded in a '...' SQL string literal.
+        return super().convert_value_re(r, state).replace("'", "''")
+
     def convert_condition_field_eq_val_str(
         self, cond: ConditionFieldEqualsValueExpression, state: ConversionState
     ) -> Union[str, DeferredQueryExpression]:
@@ -626,7 +639,10 @@ class sqliteBackend(TextQueryBackend):
         # TODO : fields support will be handled with a backend option (all fields by default)
         # fields = "*" if len(rule.fields) == 0 else f"*, {', '.join(rule.fields)}"
 
-        sqlite_query = f"SELECT * FROM {self.table} WHERE {query}"
+        # Table name can be overridden per-pipeline via a setState transformation
+        # setting the "table" state key, else fall back to the backend default.
+        table = state.processing_state.get("table", self.table)
+        sqlite_query = f"SELECT * FROM {table} WHERE {query}"
 
         return sqlite_query