pySigma 1.3.1__tar.gz → 1.3.2__tar.gz

{pysigma-1.3.1 → pysigma-1.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pySigma
-Version: 1.3.1
+Version: 1.3.2
 Summary: Sigma rule processing and conversion tools
 License-Expression: LGPL-2.1-only
 License-File: LICENSE

{pysigma-1.3.1 → pysigma-1.3.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pySigma"
-version = "1.3.1"
+version = "1.3.2"
 license = "LGPL-2.1-only"
 description = "Sigma rule processing and conversion tools"
 authors = [

{pysigma-1.3.1 → pysigma-1.3.2}/sigma/validators/core/tags.py

@@ -43,7 +43,10 @@ class ATTACKTagValidator(SigmaTagValidator):
     """Check for usage of valid MITRE ATT&CK tags."""
 
     def __init__(self) -> None:
-        self.allowed_tags = (
+        self.allowed_tags: set[str] | None = None
+
+    def _load_allowed_tags(self) -> set[str]:
+        return (
             {tactic.lower() for tactic in mitre_attack.mitre_attack_tactics.values()}
             .union({technique.lower() for technique in mitre_attack.mitre_attack_techniques.keys()})
             .union(
@@ -62,6 +65,8 @@ class ATTACKTagValidator(SigmaTagValidator):
         )
 
     def validate_tag(self, tag: SigmaRuleTag) -> list[SigmaValidationIssue]:
+        if self.allowed_tags is None:
+            self.allowed_tags = self._load_allowed_tags()
         if tag.namespace == "attack" and tag.name not in self.allowed_tags:
             return [InvalidATTACKTagIssue([self.rule], tag)]
         return []
@@ -78,13 +83,18 @@ class D3FENDTagValidator(SigmaTagValidator):
     """Check for usage of valid MITRE D3FEND tags."""
 
     def __init__(self) -> None:
-        self.allowed_tags = (
+        self.allowed_tags: set[str] | None = None
+
+    def _load_allowed_tags(self) -> set[str]:
+        return (
             {tactic.lower() for tactic in mitre_d3fend.mitre_d3fend_tactics.keys()}
             .union({technique.lower() for technique in mitre_d3fend.mitre_d3fend_techniques.keys()})
             .union({artefact for artefact in mitre_d3fend.mitre_d3fend_artifacts.keys()})
         )
 
     def validate_tag(self, tag: SigmaRuleTag) -> list[SigmaValidationIssue]:
+        if self.allowed_tags is None:
+            self.allowed_tags = self._load_allowed_tags()
         if tag.namespace == "d3fend" and tag.name not in self.allowed_tags:
             return [InvalidD3FENDagIssue([self.rule], tag)]
         return []