secrulekit 1.2.0__py3-none-any.whl

secrulekit/__init__.py

@@ -0,0 +1,19 @@
+"""SecRuleKit — Security detection rule parser, validator, and converter."""
+
+from secrulekit.parsers.yara_parser import YaraParser
+from secrulekit.parsers.sigma_parser import SigmaParser
+from secrulekit.parsers.suricata_parser import SuricataParser
+from secrulekit.validators.rule_validator import RuleValidator, ValidationResult
+from secrulekit.converters.converter import RuleConverter
+
+__version__ = "1.2.0"
+__author__ = "Cherno.x"
+
+__all__ = [
+    "YaraParser",
+    "SigmaParser",
+    "SuricataParser",
+    "RuleValidator",
+    "ValidationResult",
+    "RuleConverter",
+]

secrulekit/cli.py

@@ -0,0 +1,244 @@
+"""SecRuleKit CLI — entry point."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import click
+from rich.console import Console
+from rich.table import Table
+from rich import box
+
+from secrulekit import __version__
+from secrulekit.validators.rule_validator import RuleValidator, Severity
+from secrulekit.converters.converter import RuleConverter, SUPPORTED_TARGETS, ConversionError
+from secrulekit.parsers.sigma_parser import SigmaParser, SigmaParseError
+from secrulekit.reporters.json_reporter import JsonReporter
+from secrulekit.reporters.html_reporter import HtmlReporter
+
+console = Console()
+err_console = Console(stderr=True)
+
+
+@click.group()
+@click.version_option(__version__, prog_name="secrulekit")
+def main() -> None:
+    """SecRuleKit — security detection rule parser, validator, and converter."""
+
+
+# ------------------------------------------------------------------ #
+#  validate
+# ------------------------------------------------------------------ #
+
+@main.command()
+@click.argument("path", type=click.Path(exists=True))
+@click.option("-f", "--format", "fmt",
+              type=click.Choice(["yara", "sigma", "suricata", "snort", "auto"], case_sensitive=False),
+              default="auto", show_default=True, help="Rule format")
+@click.option("-r", "--recursive", is_flag=True, default=True, show_default=True,
+              help="Recurse into subdirectories")
+@click.option("--strict", is_flag=True, help="Treat warnings as errors")
+@click.option("--report", "report_file", type=click.Path(), default=None,
+              help="Write report to FILE (.json or .html)")
+@click.option("--no-color", is_flag=True, help="Disable colored output")
+def validate(path: str, fmt: str, recursive: bool, strict: bool, report_file: str | None, no_color: bool) -> None:
+    """Validate rule files for syntax and semantic errors."""
+    if no_color:
+        console._force_terminal = False  # type: ignore[attr-defined]
+
+    validator = RuleValidator(strict=strict)
+    result = validator.validate_path(Path(path), fmt=fmt)
+
+    # Print findings table
+    table = Table(box=box.SIMPLE_HEAD, show_edge=False)
+    table.add_column("Severity", style="bold", width=10)
+    table.add_column("Code", width=10)
+    table.add_column("Rule", width=30)
+    table.add_column("Message")
+    table.add_column("Location", style="dim")
+
+    severity_style = {
+        Severity.ERROR: "red",
+        Severity.WARNING: "yellow",
+        Severity.INFO: "blue",
+    }
+
+    for f in result.findings:
+        table.add_row(
+            f"[{severity_style[f.severity]}]{f.severity.value.upper()}[/]",
+            f.code,
+            f.rule_name or "",
+            f.message,
+            f"{f.file}:{f.line}" if f.file else "",
+        )
+
+    console.print(table)
+    console.print(f"\n{result.summary()}")
+
+    if report_file:
+        rpath = Path(report_file)
+        if rpath.suffix.lower() == ".html":
+            HtmlReporter().generate(result, output=rpath)
+        else:
+            JsonReporter().generate(result, output=rpath)
+        console.print(f"[dim]Report written to {rpath}[/]")
+
+    sys.exit(0 if result.passed else 1)
+
+
+# ------------------------------------------------------------------ #
+#  convert
+# ------------------------------------------------------------------ #
+
+@main.command()
+@click.argument("path", type=click.Path(exists=True))
+@click.option("--to", "target",
+              type=click.Choice(list(SUPPORTED_TARGETS), case_sensitive=False),
+              required=True, help="Target format")
+@click.option("-o", "--output", "output_file", type=click.Path(), default=None,
+              help="Write output to FILE (default: stdout)")
+@click.option("--batch", is_flag=True, help="Convert all .yml files in a directory")
+def convert(path: str, target: str, output_file: str | None, batch: bool) -> None:
+    """Convert Sigma rules to another format."""
+    converter = RuleConverter()
+    parser = SigmaParser()
+    results = []
+
+    if batch or Path(path).is_dir():
+        rules = list(parser.parse_directory(Path(path)))
+    else:
+        try:
+            rules = [parser.parse_file(Path(path))]
+        except SigmaParseError as e:
+            err_console.print(f"[red]Parse error:[/] {e}")
+            sys.exit(1)
+
+    for rule in rules:
+        try:
+            output = converter.convert(rule, target)
+            results.append(output)
+        except ConversionError as e:
+            err_console.print(f"[yellow]Skipped '{rule.title}':[/] {e}")
+
+    combined = "\n\n".join(results)
+    if output_file:
+        Path(output_file).write_text(combined, encoding="utf-8")
+        console.print(f"[green]Wrote {len(results)} rule(s) to {output_file}[/]")
+    else:
+        console.print(combined)
+
+
+# ------------------------------------------------------------------ #
+#  info
+# ------------------------------------------------------------------ #
+
+@main.command()
+@click.argument("path", type=click.Path(exists=True))
+def info(path: str) -> None:
+    """Display rule metadata and ATT&CK mapping."""
+    from secrulekit.utils.helpers import iter_attack_tags
+
+    parser = SigmaParser()
+    try:
+        rule = parser.parse_file(Path(path))
+    except SigmaParseError as e:
+        err_console.print(f"[red]Parse error:[/] {e}")
+        sys.exit(1)
+
+    console.print(f"[bold]{rule.title}[/]")
+    if rule.id:
+        console.print(f"  ID:          {rule.id}")
+    if rule.status:
+        console.print(f"  Status:      {rule.status}")
+    if rule.level:
+        console.print(f"  Severity:    {rule.level}")
+    if rule.author:
+        console.print(f"  Author:      {rule.author}")
+    if rule.description:
+        console.print(f"  Description: {rule.description}")
+
+    tactics = rule.attack_tactics
+    if tactics:
+        console.print(f"  Tactics:     {', '.join(tactics)}")
+
+    techniques = list(iter_attack_tags(rule))
+    if techniques:
+        console.print("  Techniques:")
+        for tid, tname in techniques:
+            console.print(f"    {tid}  {tname or '(unknown)'}")
+
+
+# ------------------------------------------------------------------ #
+#  stats
+# ------------------------------------------------------------------ #
+
+@main.command()
+@click.argument("path", type=click.Path(exists=True))
+@click.option("-f", "--format", "fmt",
+              type=click.Choice(["sigma", "yara", "suricata", "auto"], case_sensitive=False),
+              default="auto")
+def stats(path: str, fmt: str) -> None:
+    """Show statistics for a rule collection."""
+    from secrulekit.parsers.yara_parser import YaraParser
+    from secrulekit.parsers.suricata_parser import SuricataParser
+    from collections import Counter
+
+    p = Path(path)
+
+    if fmt in ("sigma", "auto") and (p.is_dir() or p.suffix in (".yml", ".yaml")):
+        rules = list(SigmaParser().parse_directory(p) if p.is_dir() else [SigmaParser().parse_file(p)])
+        levels = Counter(r.level or "unknown" for r in rules)
+        tactics = Counter(t for r in rules for t in r.attack_tactics)
+        console.print(f"[bold]Sigma rules:[/] {len(rules)}")
+        console.print("Severity breakdown:")
+        for lvl, cnt in levels.most_common():
+            console.print(f"  {lvl:15s} {cnt}")
+        if tactics:
+            console.print("Top ATT&CK tactics:")
+            for tactic, cnt in tactics.most_common(5):
+                console.print(f"  {tactic:30s} {cnt}")
+    elif fmt in ("yara", "auto"):
+        rules = list(YaraParser().parse_directory(p) if p.is_dir() else YaraParser().parse_file(p))
+        console.print(f"[bold]YARA rules:[/] {len(rules)}")
+        with_meta = sum(1 for r in rules if r.meta)
+        console.print(f"  With metadata:  {with_meta}")
+        console.print(f"  Without meta:   {len(rules) - with_meta}")
+
+
+# ------------------------------------------------------------------ #
+#  dedup
+# ------------------------------------------------------------------ #
+
+@main.command()
+@click.argument("path", type=click.Path(exists=True))
+@click.option("-f", "--format", "fmt",
+              type=click.Choice(["yara", "sigma", "suricata", "auto"], case_sensitive=False),
+              default="auto")
+@click.option("-o", "--output", "output_dir", type=click.Path(), default=None,
+              help="Write deduplicated rules to OUTPUT_DIR")
+def dedup(path: str, fmt: str, output_dir: str | None) -> None:
+    """Find and remove duplicate rules from a collection."""
+    from secrulekit.utils.helpers import deduplicate_rules
+    from secrulekit.parsers.yara_parser import YaraParser
+    from secrulekit.parsers.suricata_parser import SuricataParser
+
+    p = Path(path)
+
+    if fmt in ("sigma", "auto") and (p.is_dir() or p.suffix in (".yml", ".yaml")):
+        rules = list(SigmaParser().parse_directory(p) if p.is_dir() else [SigmaParser().parse_file(p)])
+    else:
+        rules = list(YaraParser().parse_directory(p) if p.is_dir() else YaraParser().parse_file(p))
+
+    unique, dupes = deduplicate_rules(rules)
+    console.print(f"Total: {len(rules)}  Unique: {len(unique)}  Duplicates: {len(dupes)}")
+
+    if dupes:
+        console.print("\n[yellow]Duplicate rules:[/]")
+        for r in dupes:
+            name = r.title if isinstance(r, SigmaParser.__class__) else getattr(r, "name", str(r))
+            console.print(f"  {getattr(r, 'source_file', '')}  {getattr(r, 'title', getattr(r, 'name', ''))}")
+
+
+if __name__ == "__main__":
+    main()

secrulekit/converters/__init__.py

@@ -0,0 +1,3 @@
+from secrulekit.converters.converter import RuleConverter
+
+__all__ = ["RuleConverter"]

secrulekit/converters/converter.py

@@ -0,0 +1,208 @@
+"""Sigma rule conversion engine — converts to Splunk SPL, ElasticSearch, YARA-L, QRadar AQL, Suricata."""
+
+from __future__ import annotations
+
+import json
+from typing import Any, Dict, List, Optional
+
+from secrulekit.parsers.sigma_parser import SigmaRule
+
+SUPPORTED_TARGETS = ("splunk", "elastic", "yaral", "qradar", "suricata")
+
+
+class ConversionError(Exception):
+    pass
+
+
+class RuleConverter:
+    """Convert Sigma rules to various SIEM/detection platform query languages."""
+
+    def convert(self, rule: SigmaRule, target: str) -> str:
+        target = target.lower()
+        if target not in SUPPORTED_TARGETS:
+            raise ConversionError(
+                f"Unsupported target '{target}'. Supported: {', '.join(SUPPORTED_TARGETS)}"
+            )
+        method = getattr(self, f"to_{target}")
+        return method(rule)
+
+    # ------------------------------------------------------------------ #
+    #  Splunk SPL
+    # ------------------------------------------------------------------ #
+
+    def to_splunk(self, rule: SigmaRule) -> str:
+        """Convert Sigma rule to Splunk SPL search."""
+        parts: List[str] = []
+        detection = rule.detection
+
+        for key, value in detection.items():
+            if key == "condition":
+                continue
+            parts.extend(self._sigma_selection_to_splunk(key, value))
+
+        condition = detection.get("condition", "selection")
+        source_clause = self._logsource_to_splunk_index(rule.logsource)
+
+        where_clauses = " AND ".join(parts) if parts else "*"
+        comment = f"| `comment(\"{rule.title}\")`" if rule.title else ""
+        return f"index={source_clause} {where_clauses}{comment}"
+
+    def _sigma_selection_to_splunk(self, key: str, value: Any) -> List[str]:
+        if isinstance(value, dict):
+            clauses = []
+            for field_name, field_val in value.items():
+                field_name = field_name.replace("|contains", "").replace("|startswith", "").replace("|endswith", "")
+                if isinstance(field_val, list):
+                    or_parts = " OR ".join(f'{field_name}="{v}"' for v in field_val)
+                    clauses.append(f"({or_parts})")
+                else:
+                    clauses.append(f'{field_name}="{field_val}"')
+            return clauses
+        if isinstance(value, list):
+            return [f'"{v}"' for v in value]
+        return [f'"{value}"']
+
+    def _logsource_to_splunk_index(self, logsource: Dict[str, Any]) -> str:
+        category = logsource.get("category", "")
+        product = logsource.get("product", "")
+        if "windows" in product.lower():
+            return "wineventlog"
+        if "linux" in product.lower():
+            return "syslog"
+        if "network" in category.lower():
+            return "network"
+        return "*"
+
+    # ------------------------------------------------------------------ #
+    #  ElasticSearch Query DSL
+    # ------------------------------------------------------------------ #
+
+    def to_elastic(self, rule: SigmaRule) -> str:
+        """Convert Sigma rule to ElasticSearch Query DSL (JSON)."""
+        must_clauses: List[Dict] = []
+        detection = rule.detection
+
+        for key, value in detection.items():
+            if key == "condition":
+                continue
+            if isinstance(value, dict):
+                for field_name, field_val in value.items():
+                    field_name = field_name.split("|")[0]
+                    if isinstance(field_val, list):
+                        must_clauses.append(
+                            {"bool": {"should": [{"match": {field_name: v}} for v in field_val]}}
+                        )
+                    else:
+                        must_clauses.append({"match": {field_name: field_val}})
+
+        query = {
+            "query": {
+                "bool": {
+                    "must": must_clauses if must_clauses else [{"match_all": {}}]
+                }
+            }
+        }
+        return json.dumps(query, indent=2)
+
+    # ------------------------------------------------------------------ #
+    #  YARA-L (Google SecOps / Chronicle)
+    # ------------------------------------------------------------------ #
+
+    def to_yaral(self, rule: SigmaRule) -> str:
+        """Convert Sigma rule to YARA-L 2.0 skeleton."""
+        safe_name = rule.title.lower().replace(" ", "_").replace("-", "_")[:64]
+        meta_lines = [f'  title = "{rule.title}"']
+        if rule.description:
+            meta_lines.append(f'  description = "{rule.description}"')
+        if rule.id:
+            meta_lines.append(f'  id = "{rule.id}"')
+        if rule.level:
+            meta_lines.append(f'  severity = "{rule.level.upper()}"')
+        for tag in rule.attack_techniques:
+            meta_lines.append(f'  mitre_attack_technique = "{tag}"')
+
+        events_lines = ["  $e.metadata.event_type = \"GENERIC_EVENT\""]
+        for key, value in rule.detection.items():
+            if key == "condition":
+                continue
+            if isinstance(value, dict):
+                for field_name, field_val in value.items():
+                    field_name = field_name.split("|")[0]
+                    if isinstance(field_val, list):
+                        or_expr = " or ".join(f'$e.target.process.command_line = "{v}"' for v in field_val)
+                        events_lines.append(f"  ({or_expr})")
+                    else:
+                        events_lines.append(f'  $e.target.process.command_line = "{field_val}"')
+
+        return (
+            f"rule {safe_name} {{\n"
+            f"  meta:\n"
+            + "\n".join(f"    {l}" for l in meta_lines) + "\n"
+            f"  events:\n"
+            + "\n".join(f"    {l}" for l in events_lines) + "\n"
+            f"  condition:\n"
+            f"    $e\n"
+            f"}}\n"
+        )
+
+    # ------------------------------------------------------------------ #
+    #  QRadar AQL
+    # ------------------------------------------------------------------ #
+
+    def to_qradar(self, rule: SigmaRule) -> str:
+        """Convert Sigma rule to QRadar AQL query."""
+        where_parts: List[str] = []
+
+        for key, value in rule.detection.items():
+            if key == "condition":
+                continue
+            if isinstance(value, dict):
+                for field_name, field_val in value.items():
+                    field_name = field_name.split("|")[0]
+                    if isinstance(field_val, list):
+                        or_parts = " OR ".join(f"LOGSOURCETYPENAME(devicetype) ILIKE '%{v}%'" for v in field_val)
+                        where_parts.append(f"({or_parts})")
+                    else:
+                        where_parts.append(f'"{field_name}" ILIKE \'%{field_val}%\'')
+
+        where_clause = " AND ".join(where_parts) if where_parts else "1=1"
+        return (
+            f"SELECT UTF8(payload) as 'Payload', sourceip, destinationip, "
+            f"LOGSOURCETYPENAME(devicetype) as 'Log Source Type', "
+            f"CATEGORYNAME(category) as 'Category'\n"
+            f"FROM events\n"
+            f"WHERE {where_clause}\n"
+            f"LAST 24 HOURS"
+        )
+
+    # ------------------------------------------------------------------ #
+    #  Suricata
+    # ------------------------------------------------------------------ #
+
+    def to_suricata(self, rule: SigmaRule) -> str:
+        """Generate a Suricata rule skeleton from a Sigma rule."""
+        safe_msg = rule.title.replace('"', '\\"')
+        sid = rule.id[:8].replace("-", "") if rule.id else "9000000"
+        try:
+            sid_int = int(sid, 16)
+        except ValueError:
+            sid_int = 9000000
+
+        content_options: List[str] = []
+        for key, value in rule.detection.items():
+            if key == "condition":
+                continue
+            if isinstance(value, dict):
+                for _, field_val in value.items():
+                    vals = field_val if isinstance(field_val, list) else [field_val]
+                    for v in vals:
+                        if isinstance(v, str) and len(v) < 128:
+                            content_options.append(f'content:"{v}"; nocase;')
+
+        options_str = " ".join(content_options) or 'content:"";'
+        return (
+            f'alert tcp any any -> any any '
+            f'(msg:"{safe_msg}"; {options_str} '
+            f'sid:{sid_int}; rev:1; '
+            f'classtype:attempted-admin;)'
+        )

secrulekit/parsers/__init__.py

@@ -0,0 +1,5 @@
+from secrulekit.parsers.yara_parser import YaraParser
+from secrulekit.parsers.sigma_parser import SigmaParser
+from secrulekit.parsers.suricata_parser import SuricataParser
+
+__all__ = ["YaraParser", "SigmaParser", "SuricataParser"]

secrulekit/parsers/sigma_parser.py

@@ -0,0 +1,109 @@
+"""Sigma rule parser — parses YAML-based Sigma detection rules."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Dict, Iterator, List, Optional
+
+import yaml
+
+
+@dataclass
+class SigmaRule:
+    title: str
+    id: Optional[str] = None
+    status: Optional[str] = None
+    description: Optional[str] = None
+    author: Optional[str] = None
+    date: Optional[str] = None
+    modified: Optional[str] = None
+    tags: List[str] = field(default_factory=list)
+    logsource: Dict[str, Any] = field(default_factory=dict)
+    detection: Dict[str, Any] = field(default_factory=dict)
+    falsepositives: List[str] = field(default_factory=list)
+    level: Optional[str] = None
+    source_file: Optional[Path] = None
+
+    @property
+    def attack_techniques(self) -> List[str]:
+        return [t.replace("attack.t", "T").replace("attack.T", "T") for t in self.tags if "attack.t" in t.lower()]
+
+    @property
+    def attack_tactics(self) -> List[str]:
+        tactics = {
+            "initial_access", "execution", "persistence", "privilege_escalation",
+            "defense_evasion", "credential_access", "discovery", "lateral_movement",
+            "collection", "command_and_control", "exfiltration", "impact",
+        }
+        return [t.replace("attack.", "") for t in self.tags if t.replace("attack.", "") in tactics]
+
+
+class SigmaParseError(Exception):
+    def __init__(self, message: str, file: Optional[Path] = None):
+        self.file = file
+        super().__init__(f"{file}: {message}" if file else message)
+
+
+class SigmaParser:
+    """Parse Sigma rules from YAML files or directories."""
+
+    def parse_string(self, content: str, source_file: Optional[Path] = None) -> SigmaRule:
+        """Parse a single Sigma rule from a YAML string."""
+        try:
+            data = yaml.safe_load(content)
+        except yaml.YAMLError as e:
+            raise SigmaParseError(f"YAML parse error: {e}", file=source_file)
+
+        if not isinstance(data, dict):
+            raise SigmaParseError("Rule must be a YAML mapping", file=source_file)
+
+        if "title" not in data:
+            raise SigmaParseError("Missing required field: title", file=source_file)
+        if "detection" not in data:
+            raise SigmaParseError("Missing required field: detection", file=source_file)
+
+        return SigmaRule(
+            title=data["title"],
+            id=data.get("id"),
+            status=data.get("status"),
+            description=data.get("description"),
+            author=data.get("author"),
+            date=str(data.get("date", "")),
+            modified=str(data.get("modified", "")),
+            tags=data.get("tags", []) or [],
+            logsource=data.get("logsource", {}),
+            detection=data["detection"],
+            falsepositives=data.get("falsepositives", []) or [],
+            level=data.get("level"),
+            source_file=source_file,
+        )
+
+    def parse_file(self, path: Path | str) -> SigmaRule:
+        """Parse a Sigma rule from a YAML file."""
+        path = Path(path)
+        try:
+            content = path.read_text(encoding="utf-8")
+        except OSError as e:
+            raise SigmaParseError(f"Cannot read file: {e}", file=path)
+        return self.parse_string(content, source_file=path)
+
+    def parse_directory(
+        self,
+        directory: Path | str,
+        recursive: bool = True,
+    ) -> Iterator[SigmaRule]:
+        """Yield Sigma rules from all .yml/.yaml files in a directory."""
+        directory = Path(directory).resolve()
+        if not directory.is_dir():
+            raise SigmaParseError(f"Not a directory: {directory}")
+
+        glob = "**/*" if recursive else "*"
+        for ext in ("*.yml", "*.yaml"):
+            for path in sorted(directory.glob(f"{glob[:-1]}{ext[1:]}" if glob != "*" else ext)):
+                if not path.resolve().is_relative_to(directory):
+                    continue
+                try:
+                    yield self.parse_file(path)
+                except SigmaParseError:
+                    pass