secrulekit 1.2.0__py3-none-any.whl

secrulekit/validators/rule_validator.py

@@ -0,0 +1,276 @@
+"""Multi-format rule validator."""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+from enum import Enum
+from pathlib import Path
+from typing import Iterable, List, Optional, Union
+
+from secrulekit.parsers.yara_parser import YaraRule, YaraParser, YaraParseError
+from secrulekit.parsers.sigma_parser import SigmaRule, SigmaParser, SigmaParseError
+from secrulekit.parsers.suricata_parser import SuricataRule, SuricataParser, SuricataParseError
+
+
+class Severity(str, Enum):
+    ERROR = "error"
+    WARNING = "warning"
+    INFO = "info"
+
+
+@dataclass
+class Finding:
+    severity: Severity
+    code: str
+    message: str
+    rule_name: Optional[str] = None
+    file: Optional[Path] = None
+    line: int = 0
+
+
+@dataclass
+class ValidationResult:
+    findings: List[Finding] = field(default_factory=list)
+    valid_count: int = 0
+    error_count: int = 0
+    warning_count: int = 0
+
+    def add(self, finding: Finding) -> None:
+        self.findings.append(finding)
+        if finding.severity == Severity.ERROR:
+            self.error_count += 1
+        elif finding.severity == Severity.WARNING:
+            self.warning_count += 1
+
+    @property
+    def passed(self) -> bool:
+        return self.error_count == 0
+
+    def summary(self) -> str:
+        total = self.valid_count + self.error_count
+        return (
+            f"{self.valid_count}/{total} rules valid, "
+            f"{self.error_count} errors, {self.warning_count} warnings"
+        )
+
+
+class RuleValidator:
+    """Validate YARA, Sigma, and Suricata rules."""
+
+    def __init__(self, strict: bool = False):
+        self.strict = strict
+
+    # ------------------------------------------------------------------ #
+    #  YARA
+    # ------------------------------------------------------------------ #
+
+    def validate_yara(self, rule: YaraRule) -> List[Finding]:
+        findings: List[Finding] = []
+
+        if not rule.condition:
+            findings.append(Finding(
+                Severity.ERROR, "YARA001",
+                "Rule has no condition block",
+                rule_name=rule.name, file=rule.source_file, line=rule.line_number,
+            ))
+
+        if not rule.strings and "filesize" not in rule.condition and "all" not in rule.condition:
+            findings.append(Finding(
+                Severity.WARNING, "YARA002",
+                "Rule has no strings and condition may never match",
+                rule_name=rule.name, file=rule.source_file, line=rule.line_number,
+            ))
+
+        # Warn about overly broad conditions
+        if rule.condition.strip() in ("true", "any of them"):
+            findings.append(Finding(
+                Severity.WARNING, "YARA003",
+                f"Overly broad condition: '{rule.condition.strip()}'",
+                rule_name=rule.name, file=rule.source_file, line=rule.line_number,
+            ))
+
+        # Check for potentially slow regex strings (no anchoring hint)
+        for s in rule.strings:
+            if s.type == "regex" and not s.value.startswith("/^"):
+                findings.append(Finding(
+                    Severity.INFO, "YARA004",
+                    f"Unanchored regex string '{s.name}' may be slow on large files",
+                    rule_name=rule.name, file=rule.source_file, line=rule.line_number,
+                ))
+
+        # Missing recommended meta fields
+        for meta_key in ("description", "author"):
+            if meta_key not in rule.meta:
+                findings.append(Finding(
+                    Severity.WARNING if self.strict else Severity.INFO,
+                    "YARA005",
+                    f"Missing recommended meta field: {meta_key}",
+                    rule_name=rule.name, file=rule.source_file, line=rule.line_number,
+                ))
+
+        return findings
+
+    # ------------------------------------------------------------------ #
+    #  Sigma
+    # ------------------------------------------------------------------ #
+
+    def validate_sigma(self, rule: SigmaRule) -> List[Finding]:
+        findings: List[Finding] = []
+
+        if not rule.logsource:
+            findings.append(Finding(
+                Severity.ERROR, "SIGMA001",
+                "Missing logsource block",
+                rule_name=rule.title, file=rule.source_file,
+            ))
+
+        if not rule.detection:
+            findings.append(Finding(
+                Severity.ERROR, "SIGMA002",
+                "Missing detection block",
+                rule_name=rule.title, file=rule.source_file,
+            ))
+
+        if "condition" not in rule.detection:
+            findings.append(Finding(
+                Severity.ERROR, "SIGMA003",
+                "detection block has no condition field",
+                rule_name=rule.title, file=rule.source_file,
+            ))
+
+        if rule.level not in (None, "informational", "low", "medium", "high", "critical"):
+            findings.append(Finding(
+                Severity.WARNING, "SIGMA004",
+                f"Unknown severity level: '{rule.level}'",
+                rule_name=rule.title, file=rule.source_file,
+            ))
+
+        if not rule.id:
+            findings.append(Finding(
+                Severity.WARNING if self.strict else Severity.INFO,
+                "SIGMA005",
+                "Rule has no UUID id field",
+                rule_name=rule.title, file=rule.source_file,
+            ))
+
+        return findings
+
+    # ------------------------------------------------------------------ #
+    #  Suricata
+    # ------------------------------------------------------------------ #
+
+    def validate_suricata(self, rule: SuricataRule) -> List[Finding]:
+        findings: List[Finding] = []
+
+        if not rule.sid:
+            findings.append(Finding(
+                Severity.ERROR, "SURI001",
+                "Rule has no sid option",
+                file=rule.source_file, line=rule.line_number,
+            ))
+
+        if not rule.msg:
+            findings.append(Finding(
+                Severity.WARNING, "SURI002",
+                "Rule has no msg option",
+                file=rule.source_file, line=rule.line_number,
+            ))
+
+        if "rev" not in rule.options:
+            findings.append(Finding(
+                Severity.INFO, "SURI003",
+                "Rule has no rev option",
+                file=rule.source_file, line=rule.line_number,
+            ))
+
+        return findings
+
+    # ------------------------------------------------------------------ #
+    #  Batch helpers
+    # ------------------------------------------------------------------ #
+
+    def validate_batch(
+        self,
+        rules: Iterable[Union[YaraRule, SigmaRule, SuricataRule]],
+    ) -> ValidationResult:
+        result = ValidationResult()
+        for rule in rules:
+            if isinstance(rule, YaraRule):
+                findings = self.validate_yara(rule)
+            elif isinstance(rule, SigmaRule):
+                findings = self.validate_sigma(rule)
+            elif isinstance(rule, SuricataRule):
+                findings = self.validate_suricata(rule)
+            else:
+                continue
+
+            if any(f.severity == Severity.ERROR for f in findings):
+                result.error_count += 1
+            else:
+                result.valid_count += 1
+            for f in findings:
+                result.add(f)
+
+        return result
+
+    def validate_path(self, path: Path | str, fmt: str = "auto") -> ValidationResult:
+        """Validate rules at a file or directory path."""
+        path = Path(path)
+        result = ValidationResult()
+
+        if fmt == "auto":
+            fmt = _detect_format(path)
+
+        if fmt == "yara":
+            parser = YaraParser()
+            try:
+                rules = list(parser.parse_directory(path) if path.is_dir() else parser.parse_file(path))
+            except YaraParseError as e:
+                result.add(Finding(Severity.ERROR, "PARSE001", str(e), file=path))
+                return result
+            for rule in rules:
+                for f in self.validate_yara(rule):
+                    result.add(f)
+                if not any(f.severity == Severity.ERROR for f in self.validate_yara(rule)):
+                    result.valid_count += 1
+                else:
+                    result.error_count += 1
+
+        elif fmt == "sigma":
+            parser = SigmaParser()
+            try:
+                rules = list(parser.parse_directory(path) if path.is_dir() else [parser.parse_file(path)])
+            except SigmaParseError as e:
+                result.add(Finding(Severity.ERROR, "PARSE001", str(e), file=path))
+                return result
+            result = self.validate_batch(rules)
+
+        elif fmt == "suricata":
+            parser = SuricataParser()
+            try:
+                rules = list(parser.parse_directory(path) if path.is_dir() else parser.parse_file(path))
+            except SuricataParseError as e:
+                result.add(Finding(Severity.ERROR, "PARSE001", str(e), file=path))
+                return result
+            result = self.validate_batch(rules)
+
+        return result
+
+
+def _detect_format(path: Path) -> str:
+    if path.is_dir():
+        # Guess by majority extension
+        yara = sum(1 for _ in path.glob("**/*.ya*"))
+        sigma = sum(1 for _ in path.glob("**/*.yml")) + sum(1 for _ in path.glob("**/*.yaml"))
+        suricata = sum(1 for _ in path.glob("**/*.rules"))
+        return max((("yara", yara), ("sigma", sigma), ("suricata", suricata)), key=lambda x: x[1])[0]
+
+    suffix = path.suffix.lower()
+    if suffix in (".yar", ".yara"):
+        return "yara"
+    if suffix in (".yml", ".yaml"):
+        return "sigma"
+    if suffix == ".rules":
+        return "suricata"
+    return "yara"

secrulekit-1.2.0.dist-info/METADATA

@@ -0,0 +1,241 @@
+Metadata-Version: 2.4
+Name: secrulekit
+Version: 1.2.0
+Summary: Parse, validate, convert, and manage YARA, Sigma, and Suricata security detection rules
+Author-email: "Cherno.x" <long544844@gmail.com>
+Maintainer-email: "Cherno.x" <long544844@gmail.com>
+License: MIT License
+        
+        Copyright (c) 2026 Cherno.x
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+        
+Project-URL: Homepage, https://github.com/lkop32788/SecRuleKit
+Project-URL: Documentation, https://github.com/lkop32788/SecRuleKit#readme
+Project-URL: Repository, https://github.com/lkop32788/SecRuleKit
+Project-URL: Issues, https://github.com/lkop32788/SecRuleKit/issues
+Project-URL: Changelog, https://github.com/lkop32788/SecRuleKit/blob/main/CHANGELOG.md
+Project-URL: Security Policy, https://github.com/lkop32788/SecRuleKit/blob/main/SECURITY.md
+Keywords: yara,sigma,suricata,detection-rules,security,siem,threat-hunting
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: Topic :: Security
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Operating System :: OS Independent
+Classifier: Environment :: Console
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: click>=8.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: rich>=13.0
+Requires-Dist: typing-extensions>=4.0; python_version < "3.10"
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Requires-Dist: pytest-cov>=4.0; extra == "dev"
+Requires-Dist: ruff>=0.1.0; extra == "dev"
+Requires-Dist: mypy>=1.0; extra == "dev"
+Requires-Dist: types-PyYAML; extra == "dev"
+Dynamic: license-file
+
+# SecRuleKit
+
+[![PyPI version](https://badge.fury.io/py/secrulekit.svg)](https://badge.fury.io/py/secrulekit)
+[![Python 3.8+](https://img.shields.io/badge/python-3.8+-blue.svg)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![CI](https://github.com/lkop32788/SecRuleKit/actions/workflows/ci.yml/badge.svg)](https://github.com/lkop32788/SecRuleKit/actions/workflows/ci.yml)
+
+A Python toolkit for parsing, validating, converting, and managing security detection rules — supporting **YARA**, **Sigma**, and **Suricata/Snort** formats.
+
+Security teams and researchers rely on SecRuleKit to validate rule syntax before deployment, convert rules across platforms, deduplicate rule libraries, and generate audit-ready reports.
+
+## Features
+
+- **Multi-format support** — Parse and validate YARA, Sigma, and Suricata rules from files, directories, or strings
+- **Format conversion** — Convert Sigma rules to YARA skeleton, Suricata, ElasticSearch Query DSL, and Splunk SPL
+- **Rule deduplication** — Fingerprint and detect duplicate/near-duplicate rules across large rule sets
+- **Metadata enrichment** — Tag rules with MITRE ATT&CK tactics/techniques, severity, and platform
+- **Batch reporting** — Export validation results as JSON, CSV, or HTML audit reports
+- **CLI interface** — Full-featured command-line tool for CI/CD pipeline integration
+- **Python API** — Clean library API for embedding in security tooling
+
+## Installation
+
+```bash
+pip install secrulekit
+```
+
+Or install from source:
+
+```bash
+git clone https://github.com/lkop32788/SecRuleKit.git
+cd secrulekit
+pip install -e ".[dev]"
+```
+
+## Quick Start
+
+### CLI
+
+```bash
+# Validate a directory of YARA rules
+secrulekit validate --format yara ./rules/yara/
+
+# Validate Sigma rules and output JSON report
+secrulekit validate --format sigma ./rules/sigma/ --report report.json
+
+# Convert Sigma rule to Splunk SPL
+secrulekit convert --to splunk ./rules/sigma/lateral_movement.yml
+
+# Deduplicate a large rule set
+secrulekit dedup --format yara ./rules/ --output ./rules_deduped/
+
+# Show rule metadata and ATT&CK mapping
+secrulekit info ./rules/sigma/t1059_powershell.yml
+```
+
+### Python API
+
+```python
+from secrulekit import YaraParser, SigmaParser, RuleValidator, RuleConverter
+
+# Parse and validate YARA rules
+parser = YaraParser()
+rules = parser.parse_directory("./rules/yara/")
+
+validator = RuleValidator()
+results = validator.validate_batch(rules)
+print(f"Valid: {results.valid_count}, Errors: {results.error_count}")
+
+# Convert Sigma to Splunk
+converter = RuleConverter()
+sigma = SigmaParser().parse_file("./rules/sigma/t1059.yml")
+splunk_query = converter.to_splunk(sigma)
+print(splunk_query)
+
+# Generate HTML report
+from secrulekit.reporters import HtmlReporter
+HtmlReporter().generate(results, output="audit_report.html")
+```
+
+## Supported Rule Formats
+
+| Format     | Parse | Validate | Convert From | Convert To |
+|------------|-------|----------|--------------|------------|
+| YARA       | ✅    | ✅       | —            | —          |
+| Sigma      | ✅    | ✅       | ✅           | ✅         |
+| Suricata   | ✅    | ✅       | —            | ✅         |
+| Snort      | ✅    | ✅       | —            | —          |
+
+## Sigma Conversion Targets
+
+| Target              | Flag          |
+|---------------------|---------------|
+| Splunk SPL          | `--to splunk` |
+| ElasticSearch Query | `--to elastic`|
+| YARA-L              | `--to yaral`  |
+| QRadar AQL          | `--to qradar` |
+| Suricata            | `--to suricata`|
+
+## CLI Reference
+
+```
+Usage: secrulekit [OPTIONS] COMMAND [ARGS]...
+
+Commands:
+  validate   Validate rule files for syntax and semantic errors
+  convert    Convert rules between formats
+  dedup      Find and remove duplicate rules
+  info       Display rule metadata and ATT&CK mapping
+  report     Generate audit reports from cached results
+  stats      Show statistics for a rule collection
+
+Options:
+  --version  Show version
+  --help     Show help
+```
+
+### `secrulekit validate`
+
+```
+Options:
+  -f, --format [yara|sigma|suricata|snort|auto]
+                  Rule format (default: auto-detect)
+  -r, --recursive  Recurse into subdirectories
+  --strict         Treat warnings as errors
+  --report FILE    Write JSON/HTML report to FILE
+  --no-color       Disable colored output
+```
+
+### `secrulekit convert`
+
+```
+Options:
+  --to [splunk|elastic|yaral|qradar|suricata]
+                  Target format (required)
+  -o, --output FILE   Write output to file (default: stdout)
+  --batch          Convert all .yml files in directory
+```
+
+## Project Structure
+
+```
+secrulekit/
+├── secrulekit/
+│   ├── parsers/
+│   │   ├── yara_parser.py       # YARA rule parser
+│   │   ├── sigma_parser.py      # Sigma rule parser
+│   │   └── suricata_parser.py   # Suricata/Snort parser
+│   ├── validators/
+│   │   └── rule_validator.py    # Multi-format validator
+│   ├── converters/
+│   │   └── converter.py         # Format conversion engine
+│   ├── reporters/
+│   │   ├── json_reporter.py     # JSON output
+│   │   └── html_reporter.py     # HTML audit report
+│   ├── utils/
+│   │   └── helpers.py           # Fingerprinting, dedup, ATT&CK mapping
+│   └── cli.py                   # CLI entry point
+├── tests/
+├── rules/                       # Example rule sets
+│   ├── yara/
+│   └── sigma/
+└── docs/
+```
+
+## Contributing
+
+Contributions are welcome! Please read [CONTRIBUTING.md](CONTRIBUTING.md) before opening a pull request.
+
+## Security
+
+To report a security vulnerability in SecRuleKit itself (e.g., rule parsing that could cause denial-of-service or arbitrary code execution via crafted rule files), please follow the process in [SECURITY.md](SECURITY.md).
+
+**Security Maintainer:** [@lkop32788](https://github.com/lkop32788)
+
+## License
+
+MIT © 2026 Cherno.x — see [LICENSE](LICENSE).

secrulekit-1.2.0.dist-info/RECORD

@@ -0,0 +1,21 @@
+secrulekit/__init__.py,sha256=T2IGK_aCvsEU4lmkvlY42mfrJC0S2LdqkOs7tBgMvDc,578
+secrulekit/cli.py,sha256=n81W4sG1UbVOA-WBm1w1CFV5ew_NyyJM3ifGpL70LNc,9393
+secrulekit/converters/__init__.py,sha256=KctqW9cXCrI26xezL4Ref1CVFlLjTdryZYxOsZcES5A,87
+secrulekit/converters/converter.py,sha256=ILvs6_T2Z232TDxU3VDK8-7AFDnhYrFM6H5fvtblCIE,8418
+secrulekit/parsers/__init__.py,sha256=2htcrhdbudQKzUZty87fhaB-cNCgUx9d9hfe7iwrpSw,231
+secrulekit/parsers/sigma_parser.py,sha256=7kpDFIBYSkr8iaIKgqGAHavAawYvJansvmDnvGSb0ZQ,4082
+secrulekit/parsers/suricata_parser.py,sha256=2Q1pDYh4QACpa6RwqpAxS3xA2W-phf6mLNP9sr1rNXI,3997
+secrulekit/parsers/yara_parser.py,sha256=lP0HO_XPrJCH7UFIcvw7bixaYkCDzNyxYOxdguXjWqM,4797
+secrulekit/reporters/__init__.py,sha256=-7Q7AoUzqEOFwX025dufsNdkoaXKzUr3OJjecDoLW_0,164
+secrulekit/reporters/html_reporter.py,sha256=ihJzR5E0tpV-pNBCOpNJVYldhKcDmZ26d5tjimpBmN8,3606
+secrulekit/reporters/json_reporter.py,sha256=Zj8XB5cFWIZsW104RUyt2H_G8PqgDumCn7UlVq0FMb8,1167
+secrulekit/utils/__init__.py,sha256=8h_ZTZRmlinoGJ4RMTzHpkdqdbyBKzT3XFpujbklfeU,126
+secrulekit/utils/helpers.py,sha256=LZfBfmPeJ5f9WjqNKqWXAnRgQYWALzAIo-qy1iA5MHM,3494
+secrulekit/validators/__init__.py,sha256=nYkd_uFObF75w_di9N_qwSqJBVG3-ihUg3vdmJzjI2U,150
+secrulekit/validators/rule_validator.py,sha256=lxouAJp_QbjvTRVi71DAbExARPvI7z-FQ_Ktn1THSkk,9717
+secrulekit-1.2.0.dist-info/licenses/LICENSE,sha256=ouHqLPmSmwMlmSc7tWOzeRLgz3jLcz1N3Pcys9ai-bI,1065
+secrulekit-1.2.0.dist-info/METADATA,sha256=9CtuxZlQlrvEJMj0ht_lhsd3MnWFy-nTvg-oBWoVaz4,9458
+secrulekit-1.2.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+secrulekit-1.2.0.dist-info/entry_points.txt,sha256=KsJgDvejtkcaRM8lFF49LK8uQN1tbMS-DwCUtjmAOw8,51
+secrulekit-1.2.0.dist-info/top_level.txt,sha256=MSbt3LaSgXXW8bilgn7O0Clu3Rl-dKEwNfGzdG-uKYo,11
+secrulekit-1.2.0.dist-info/RECORD,,

secrulekit-1.2.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

secrulekit-1.2.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+secrulekit = secrulekit.cli:main

secrulekit-1.2.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cherno.x
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

secrulekit-1.2.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+secrulekit