sigma2sql 0.2.0__py3-none-any.whl

sigma2sql/sql.py

@@ -0,0 +1,325 @@
+"""Render Expr trees as SQL for SQLite, PostgreSQL and DuckDB."""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Mapping
+from dataclasses import dataclass, field, replace
+from typing import Any, Literal
+
+from sigma2sql.detection import compile_search
+from sigma2sql.errors import UnsupportedRule
+from sigma2sql.expr import (
+    And,
+    Cidr,
+    Compare,
+    Exists,
+    Expr,
+    FieldRef,
+    Not,
+    NullMatch,
+    NumMatch,
+    Or,
+    Regex,
+    SigmaString,
+    StrMatch,
+    Wildcard,
+)
+from sigma2sql.rule import Rule
+
+Dialect = Literal["sqlite", "postgres", "duckdb"]
+TimestampFormat = Literal["iso", "epoch_s", "epoch_ms"]
+DIALECTS: tuple[Dialect, ...] = ("sqlite", "postgres", "duckdb")
+
+# SQLite parses `a OR b OR ...` into a tree as deep as the list and stops at depth 1000,
+# which rules with long hash lists exceed. Grouping keeps the depth logarithmic.
+GROUP = 50
+# Largest {m,n} repetition count each engine accepts (SQLite uses Python's re: no limit).
+MAX_REPEAT: dict[Dialect, int | None] = {"sqlite": None, "postgres": 255, "duckdb": 1000}
+REPEAT = re.compile(r"\{(\d+)(?:,(\d*))?\}")
+# RE2 (DuckDB) has no lookaround or backreferences.
+# Word boundaries inside CamelCase names: NewValue -> New Value.
+CAMEL = re.compile(r"(?<=[a-z0-9])(?=[A-Z])")
+RE2_UNSUPPORTED = re.compile(r"\(\?<?[=!]|\\[1-9]")
+
+
+@dataclass(frozen=True)
+class Route:
+    """Logsource routing: rules whose `logsource` has every key/value in `match` read
+    from `table` (if set) and get `where` (a Sigma search map, in target field names) added.
+    """
+
+    match: Mapping[str, str]
+    table: str | None = None
+    where: Mapping[str, Any] | None = None
+
+    def applies(self, logsource: Mapping[str, str]) -> bool:
+        return all(
+            str(logsource.get(k, "")).lower() == str(v).lower() for k, v in self.match.items()
+        )
+
+
+@dataclass(frozen=True)
+class Target:
+    """Where the events live and how Sigma field names reach them.
+
+    With `json_column`, every event is one JSON object in that column and fields are
+    read as top-level keys (or, with `nested`, dotted paths into nested objects).
+    Otherwise each field is its own column. A field missing from `mapping` is looked up
+    through the `default_field` templates (`{field}` is the Sigma name, `{field_words}` the
+    same name split into words, e.g. "New Value"), or under its own name.
+    """
+
+    dialect: Dialect = "sqlite"
+    table: str = "events"
+    # Sigma field -> column/key, or a sequence of candidates tried in order.
+    mapping: Mapping[str, str | tuple[str, ...]] = field(default_factory=dict)
+    json_column: str | None = None
+    keyword_column: str | None = None
+    # Event time, used by correlations and aggregations with a timespan.
+    timestamp: str = "timestamp"
+    timestamp_format: TimestampFormat = "iso"
+    nested: bool = False
+    default_field: str | tuple[str, ...] | None = None
+    routes: tuple[Route, ...] = ()
+
+
+def to_query(rule: Rule, target: Target, columns: str = "*") -> str:
+    """SQL for a detection rule. Rules with a legacy `| count()` aggregation return
+    one row per group (and window) that meets the threshold; `columns` is then ignored."""
+    if rule.aggregation is not None:
+        from sigma2sql.correlation import correlation_query
+
+        return correlation_query(rule.aggregation, [replace(rule, aggregation=None)], target)
+    table, where = source(rule, target)
+    return f"SELECT {columns} FROM {table} WHERE {where}"
+
+
+def source(rule: Rule, target: Target) -> tuple[str, str]:
+    """The quoted table and WHERE clause for a rule, after logsource routing."""
+    where = to_where(rule.compile(), target)
+    route = next((r for r in target.routes if r.applies(rule.logsource)), None)
+    if route is None:
+        return quote_table(target.table), where
+    if route.where:
+        # Route conditions are written in target field names, so no mapping applies.
+        raw = replace(target, mapping={}, default_field=None)
+        extra = to_where(compile_search("logsource", dict(route.where)), raw)
+        where = f"({extra} AND {where})"
+    return quote_table(route.table or target.table), where
+
+
+def to_where(expr: Expr, target: Target) -> str:
+    return Renderer(target).render(expr)
+
+
+def quote_ident(name: str) -> str:
+    return '"' + name.replace('"', '""') + '"'
+
+
+def quote_table(name: str) -> str:
+    return ".".join(quote_ident(part) for part in name.split("."))
+
+
+def literal(value: str) -> str:
+    return "'" + value.replace("'", "''") + "'"
+
+
+class Renderer:
+    def __init__(self, target: Target) -> None:
+        self.t = target
+        self.d = target.dialect
+        self.json = target.json_column is not None
+
+    def render(self, expr: Expr) -> str:
+        match expr:
+            case And(items):
+                return _join([self.render(i) for i in items], "AND")
+            case Or(items):
+                return _join([self.render(i) for i in items], "OR")
+            case Not(item):
+                # A missing field makes the inner test NULL; Sigma treats that as "no match",
+                # so the negation has to come out true rather than NULL.
+                return f"NOT COALESCE({self.render(item)}, FALSE)"
+            case StrMatch(f, value, cased):
+                col = self.keyword() if f is None else self.column(f)
+                return self.string(col, value, cased)
+            case NumMatch(f, value):
+                col = self.column(f)
+                if not self.json:
+                    return f"{col} = {value}"
+                # JSON may hold 4688 or "4688"; compare the text form so both match.
+                text = f"CAST({col} AS TEXT)" if self.d == "sqlite" else col
+                return f"{text} = {literal(str(value))}"
+            case NullMatch(f):
+                return f"{self.column(f)} IS NULL"
+            case Exists(f, exists):
+                return f"{self.column(f)} IS {'NOT ' if exists else ''}NULL"
+            case Regex(f, pattern, ignore_case):
+                col = self.keyword() if f is None else self.column(f)
+                return self.regex(col, ("(?i)" if ignore_case else "") + pattern)
+            case Cidr(f, network):
+                col = self.column(f)
+                if self.d == "postgres":
+                    return f"({col})::inet <<= {literal(network)}::inet"
+                return f"cidr_match({col}, {literal(network)})"
+            case Compare(f, op, value):
+                return f"{self.number(self.column(f))} {op} {value}"
+            case FieldRef(f, other):
+                return f"{self.column(f)} = {self.column(other)}"
+        raise AssertionError(f"unhandled expression {expr!r}")
+
+    def column(self, sigma_field: str) -> str:
+        name = self.t.mapping.get(sigma_field)
+        if name is None:
+            templates = self.t.default_field
+            if isinstance(templates, str):
+                templates = (templates,)
+            name = _expand(templates, sigma_field) if templates else sigma_field
+        if not isinstance(name, str):
+            if len(name) == 1:
+                return self.path(name[0])
+            # Several candidate locations: the first one present wins.
+            return f"COALESCE({', '.join(self.path(n) for n in name)})"
+        return self.path(name)
+
+    def path(self, name: str) -> str:
+        if self.t.json_column is None:
+            return quote_ident(name)
+        col = quote_ident(self.t.json_column)
+        parts = [_dq(p) for p in (name.split(".") if self.t.nested else [name])]
+        if self.d == "postgres":
+            if len(parts) == 1:
+                return f"{col}->>{literal(name)}"
+            return f"{col}#>>{literal('{' + ','.join(parts) + '}')}"
+        path = literal("$" + "".join("." + p for p in parts))
+        if self.d == "duckdb":
+            return f"{col}->>{path}"
+        return f"json_extract({col}, {path})"
+
+    def number(self, col: str) -> str:
+        """Numeric view of a column; JSON values arrive as text in PostgreSQL and DuckDB."""
+        if not self.json:
+            return col
+        if self.d == "postgres":
+            return f"({col})::numeric"
+        if self.d == "duckdb":
+            return f"TRY_CAST({col} AS DOUBLE)"
+        return f"CAST({col} AS REAL)"
+
+    def cast_number(self, expr: str) -> str:
+        if self.d == "postgres":
+            return f"CAST({expr} AS double precision)"
+        if self.d == "duckdb":
+            return f"TRY_CAST({expr} AS DOUBLE)"
+        return f"CAST({expr} AS REAL)"
+
+    def epoch(self) -> str:
+        """Event time in seconds since 1970, from the configured timestamp field."""
+        col = self.column(self.t.timestamp)
+        fmt = self.t.timestamp_format
+        if fmt != "iso":
+            seconds = self.cast_number(col)
+            return seconds if fmt == "epoch_s" else f"({seconds} / 1000.0)"
+        if self.d == "postgres":
+            return f"EXTRACT(EPOCH FROM CAST({col} AS timestamptz))"
+        if self.d == "duckdb":
+            return f"epoch(TRY_CAST({col} AS TIMESTAMPTZ))"
+        return f"unixepoch({col}, 'subsec')"
+
+    def from_epoch(self, expr: str) -> str:
+        if self.d == "sqlite":
+            return f"datetime({expr}, 'unixepoch', 'subsec')"
+        if self.d == "postgres":
+            return f"to_timestamp({expr})"
+        # A plain (UTC) TIMESTAMP: TIMESTAMPTZ values need pytz on the Python side.
+        return f"make_timestamp(CAST(({expr}) * 1000000 AS BIGINT))"
+
+    def keyword(self) -> str:
+        if self.t.keyword_column:
+            return quote_ident(self.t.keyword_column)
+        if self.t.json_column:
+            col = quote_ident(self.t.json_column)
+            return col if self.d == "sqlite" else f"CAST({col} AS TEXT)"
+        raise UnsupportedRule("keyword searches need a keyword column or a JSON column")
+
+    def string(self, col: str, value: SigmaString, cased: bool) -> str:
+        if not value.has_wildcards:
+            text = value.text
+            if cased:
+                return f"{col} = {literal(text)}"
+            if self.d == "sqlite":
+                return f"{col} = {literal(text)} COLLATE NOCASE"
+            return f"LOWER({col}) = {literal(text.lower())}"
+        if self.d == "sqlite":
+            if cased:
+                return f"{col} GLOB {literal(_glob(value))}"
+            return f"{col} LIKE {literal(_like(value))} ESCAPE '\\'"
+        op = "LIKE" if cased else "ILIKE"
+        return f"{col} {op} {literal(_like(value))} ESCAPE '\\'"
+
+    def regex(self, col: str, pattern: str) -> str:
+        limit = MAX_REPEAT[self.d]
+        bounds = [int(n) for m in REPEAT.finditer(pattern) for n in m.groups() if n]
+        if limit is not None and any(n > limit for n in bounds):
+            raise UnsupportedRule(f"{self.d} regexes allow at most {limit} repetitions: {pattern}")
+        if self.d == "postgres":
+            return f"{col} ~ {literal(pattern)}"
+        if self.d == "duckdb":
+            if RE2_UNSUPPORTED.search(pattern):
+                raise UnsupportedRule(
+                    f"duckdb (RE2) has no lookaround or backreferences: {pattern}"
+                )
+            return f"regexp_matches({col}, {literal(pattern)})"
+        return f"{col} REGEXP {literal(pattern)}"
+
+    def same(self, a: str, b: str) -> str:
+        """Null-safe equality."""
+        return f"{a} IS {b}" if self.d == "sqlite" else f"{a} IS NOT DISTINCT FROM {b}"
+
+
+def _expand(templates: tuple[str, ...], sigma_field: str) -> tuple[str, ...]:
+    words = CAMEL.sub(" ", sigma_field)
+    names: list[str] = []
+    for template in templates:
+        name = template.replace("{field_words}", words).replace("{field}", sigma_field)
+        if name not in names:
+            names.append(name)
+    return tuple(names)
+
+
+def _dq(key: str) -> str:
+    """A double-quoted JSON path key or PostgreSQL array element."""
+    return '"' + key.replace("\\", "\\\\").replace('"', '\\"') + '"'
+
+
+def _join(parts: list[str], op: str) -> str:
+    while len(parts) > GROUP:
+        parts = [_join(parts[i : i + GROUP], op) for i in range(0, len(parts), GROUP)]
+    return "(" + f" {op} ".join(parts) + ")"
+
+
+def _like(value: SigmaString) -> str:
+    out: list[str] = []
+    for part in value.parts:
+        if part is Wildcard.MANY:
+            out.append("%")
+        elif part is Wildcard.ONE:
+            out.append("_")
+        else:
+            assert isinstance(part, str)
+            out.append(part.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_"))
+    return "".join(out)
+
+
+def _glob(value: SigmaString) -> str:
+    out: list[str] = []
+    for part in value.parts:
+        if part is Wildcard.MANY:
+            out.append("*")
+        elif part is Wildcard.ONE:
+            out.append("?")
+        else:
+            assert isinstance(part, str)
+            out.append("".join(f"[{c}]" if c in "*?[" else c for c in part))
+    return "".join(out)

sigma2sql-0.2.0.dist-info/METADATA

@@ -0,0 +1,277 @@
+Metadata-Version: 2.5
+Name: sigma2sql
+Version: 0.2.0
+Summary: Sigma rules as SQL for SQLite, PostgreSQL and DuckDB: convert, hunt through log files and test rules
+Project-URL: Homepage, https://github.com/brkozer/sigma2sql
+Project-URL: Issues, https://github.com/brkozer/sigma2sql/issues
+Project-URL: Changelog, https://github.com/brkozer/sigma2sql/blob/main/CHANGELOG.md
+Author: Ahmet Burak Özer
+License-Expression: MIT
+License-File: LICENSE
+Keywords: detection-engineering,duckdb,postgresql,siem,sigma,sql,threat-hunting
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Database
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.12
+Requires-Dist: pyyaml>=6.0.2
+Provides-Extra: duckdb
+Requires-Dist: duckdb>=1.1; extra == 'duckdb'
+Requires-Dist: numpy>=2.0; extra == 'duckdb'
+Description-Content-Type: text/markdown
+
+# sigma2sql
+
+[![ci](https://github.com/brkozer/sigma2sql/actions/workflows/ci.yml/badge.svg)](https://github.com/brkozer/sigma2sql/actions/workflows/ci.yml)
+![python](https://img.shields.io/badge/python-3.12%2B-3776AB)
+![license](https://img.shields.io/badge/license-MIT-green)
+
+Run [Sigma](https://sigmahq.io) detection rules as SQL on **SQLite**, **PostgreSQL** and
+**DuckDB**: hunt through log files without a SIEM, convert rules for the database your logs
+already live in, and unit-test rules before they reach production.
+
+- **Every SigmaHQ rule converts**: 3162 / 3162 on SQLite and DuckDB, 3160 / 3162 on
+  PostgreSQL, plus all 45 `count()` aggregation rules SigmaHQ keeps under `unsupported/`.
+  Every generated query is executed on all three databases in CI each week.
+- **Checked against real events**: all 476 of SigmaHQ's regression samples match as expected,
+  and on those events sigma2sql agrees with pySigma on 3074 of 3076 rules; the two
+  differences are IPv6 addresses pySigma's text matching misses
+  ([details](docs/correctness.md)).
+- **Correlations**: event counts, distinct counts, sums and temporal sequences over a sliding
+  window, as plain SQL.
+- **Your schema**: profiles map Sigma fields to your columns or nested JSON (Sysmon, EVTX
+  exports, Elastic/Winlogbeat ECS, OCSF built in) and limit each rule to the right log source.
+
+<p align="center"><img src="https://raw.githubusercontent.com/brkozer/sigma2sql/main/docs/demo.svg" alt="sigma2sql hunting through sample logs, checking rule tests and converting a rule to PostgreSQL" width="100%"></p>
+
+## Install
+
+```bash
+uv tool install "sigma2sql[duckdb] @ git+https://github.com/brkozer/sigma2sql"
+```
+
+The `duckdb` extra is needed for `hunt`; `convert`, `test` and `check` only need PyYAML.
+
+## Hunt through log files
+
+```bash
+git clone --depth 1 https://github.com/SigmaHQ/sigma
+sigma2sql hunt sigma/rules --logs 'logs/*.json' --profile evtx --examples 1
+```
+
+`hunt` loads JSON, JSON Lines, Parquet or CSV files into an in-memory DuckDB database, runs
+every rule and correlation, and lists the ones that matched, most severe first. On the
+examples in this repository:
+
+```console
+$ sigma2sql hunt examples/rules --logs examples/events.jsonl
+LEVEL         HITS  RULE
+high             2  PowerShell started with an encoded command  (examples/rules/encoded_powershell.yml)
+high             1  Brute force against one account  (examples/rules/brute_force.yml)
+high             1  Office application starting a shell  (examples/rules/office_spawns_shell.yml)
+medium           1  Successful RDP logon from a public address  (examples/rules/rdp_from_outside.yml)
+4 of 4 rules matched 12 events (0 rules skipped)
+```
+
+`--examples N` prints matching events (or correlation results such as
+`{"TargetUserName":"admin","window_start":"2026-11-01 03:12:01","window_end":"2026-11-01 03:12:17","value":3}`),
+`--format json` gives a machine-readable report and `--fail-on high` a non-zero exit code
+when a rule at that level or above fires.
+
+## Convert rules
+
+```console
+$ sigma2sql convert examples/rules/office_spawns_shell.yml -d postgres --json-column data
+-- Office application starting a shell (8a7f3e91-2c44-4b8e-b0f6-3e5d9c1a7b02)
+SELECT * FROM "events" WHERE (("data"->>'ParentImage' ILIKE '%\\winword.exe' ESCAPE '\' OR ...)
+  AND ("data"->>'Image' ILIKE '%\\cmd.exe' ESCAPE '\' OR ...));
+```
+
+A whole directory works the same way, e.g.
+`sigma2sql convert sigma/rules -d postgres -t security.events --json-column event --profile ecs-winlogbeat`.
+Without `--json-column` each Sigma field is a column. Unsupported rules are listed on stderr
+with the reason, and the command exits non-zero.
+
+| Option | Meaning |
+| --- | --- |
+| `-d, --dialect` | `sqlite` (default), `postgres` or `duckdb` |
+| `-t, --table` | table name, `schema.table` allowed (default `events`) |
+| `--json-column` | read fields from this JSON / JSONB column |
+| `--keyword-column` | column searched by keyword rules (in JSON mode the whole document) |
+| `-p, --profile` | built-in profile or a YAML file (see below) |
+| `-m, --mapping` | YAML map from Sigma field to your column or key, applied over the profile |
+| `--nested` | dotted names are paths into nested JSON |
+| `--timestamp-field`, `--timestamp-format` | event time for correlations (`iso`, `epoch_s`, `epoch_ms`) |
+
+## Correlations
+
+Sigma correlation rules and the older `| count() by ... > N` syntax both become SQL. With a
+`timespan`, each event closes a window over the events of the same group before it; the
+window's events are found with a self-join, which works the same on all three databases and
+allows distinct counts:
+
+```yaml
+title: Brute force against one account
+correlation:
+  type: event_count          # also value_count, value_sum, value_avg, temporal
+  rules: [failed_logon]
+  group-by: [TargetUserName]
+  timespan: 5m
+  condition: {gte: 3}
+```
+
+Each result row holds the group values, the window's start and end and the counted value.
+Rules referenced by a correlation are not reported on their own unless it sets
+`generate: true`. `temporal_ordered` is not supported yet.
+
+## Profiles
+
+A profile describes where your events keep Sigma's fields and which events each log source
+covers. `sigma2sql profiles` lists the built-in ones:
+
+| Profile | For |
+| --- | --- |
+| `sysmon` | Sysmon events with their own field names; each category limited to its event ID |
+| `evtx` | EVTX exported to JSON by evtx_dump or python-evtx (`Event.System`, `Event.EventData`) |
+| `ecs-winlogbeat` | Windows events shipped by Winlogbeat in Elastic Common Schema |
+| `ocsf` | OCSF 1.x events, time in epoch milliseconds |
+
+Your own profile is a small YAML file:
+
+```yaml
+nested: true
+timestamp: "@timestamp"
+default_field: "winlog.event_data.{field}"      # fallback for unmapped fields
+fields:
+  Image: process.executable
+  EventID: [event.code, winlog.event_id]         # first one present wins
+logsources:
+  - match: {product: windows, category: process_creation}
+    table: process_events                        # optional: route to a table
+    where: {event.code: "1"}                     # optional: extra condition
+```
+
+Without a profile, rules are not limited by log source: a network rule can then match a
+process event that happens to have the same field values. The built-in profiles cover the
+common Windows sources; for other data, add `logsources` entries.
+
+## Test rules
+
+Put example events next to a rule, one JSON object per line:
+
+```
+rules/office_spawns_shell.yml
+rules/office_spawns_shell.match.jsonl     # every event must match
+rules/office_spawns_shell.nomatch.jsonl   # no event may match
+```
+
+```console
+$ sigma2sql check examples/rules --require-tests
+ok   examples/rules/brute_force.yml
+ok   examples/rules/encoded_powershell.yml
+ok   examples/rules/office_spawns_shell.yml
+ok   examples/rules/rdp_from_outside.yml
+4 passed, 0 failed, 0 without tests
+```
+
+A failure names the rule, the file and the line, e.g. after adding an Outlook-spawned
+`cmd.exe` to the match file of a rule that only watches Word, Excel and PowerPoint:
+
+```console
+FAIL rules/office_spawns_shell.yml: Office application starting a shell: missed office_spawns_shell.match.jsonl event(s) 1
+```
+
+The same check as a GitHub Action:
+
+```yaml
+- uses: brkozer/sigma2sql@v0.2.0
+  with:
+    path: rules
+    profile: sysmon          # optional
+    require-tests: "true"    # optional
+```
+
+`sigma2sql test RULE EVENTS.jsonl` prints the events (or correlation results) a single rule
+produces.
+
+## Supported Sigma features
+
+| Feature | SQLite | PostgreSQL | DuckDB |
+| --- | --- | --- | --- |
+| maps, lists, keywords (with `all`, `re` and string modifiers) | ✓ | ✓ | ✓ |
+| `and`, `or`, `not`, `1 of x*`, `all of x*`, `them`, condition lists | ✓ | ✓ | ✓ |
+| wildcards and escapes, `contains`, `startswith`, `endswith`, `all`, `cased`, `windash` | ✓ | ✓ | ✓ |
+| `base64`, `base64offset`, `utf16`, `utf16le`, `utf16be`, `wide` | ✓ | ✓ | ✓ |
+| `re`, `re\|i` | `REGEXP` ¹ | `~` ² | `regexp_matches` ³ |
+| `cidr` (IPv4 and IPv6, any notation) | `cidr_match()` ¹ | `inet <<=` | `cidr_match()` ¹ |
+| `lt`, `lte`, `gt`, `gte`, `exists`, `fieldref`, `null` | ✓ | ✓ | ✓ |
+| correlations, `count()` aggregations | ✓ | ✓ | ✓ |
+| `expand` (placeholders), `temporal_ordered`, filter rules | – | – | – |
+
+¹ Not built into the database. `hunt`, `test` and `check` register them; when you run the SQL
+elsewhere, register `regexp(pattern, value)` and `cidr_match(value, network)` yourself
+(`sigma2sql.runner.connect()` returns a SQLite connection with both).<br>
+² PostgreSQL rejects repetition counts above 255; those two rules are reported as unsupported
+rather than silently changed.<br>
+³ RE2: no lookaround or backreferences; such rules are reported as unsupported on DuckDB.
+
+Matching is case-insensitive by default (ASCII in SQLite, as its `LIKE` and `NOCASE` are);
+values in a JSON column match whether they are stored as `4624` or `"4624"`, and `not` on a
+missing field is true, as Sigma intends.
+
+## How it works
+
+```mermaid
+flowchart LR
+    Y[rule files] --> L[loader<br/>rules, correlations,<br/>count aggregations]
+    L --> C[condition parser]
+    L --> D[search compiler<br/>modifiers, wildcards,<br/>base64, windash]
+    C --> E[match tree]
+    D --> E
+    P[profile<br/>fields, logsources,<br/>timestamp] --> R
+    E --> R[renderer<br/>SQLite · PostgreSQL · DuckDB]
+    R --> Q[SQL]
+    R --> K[correlation SQL<br/>self-join windows]
+    Q --> H[hunt / test / check]
+    K --> H
+```
+
+## Library use
+
+```python
+from sigma2sql import Target, load_rule_file, to_query
+from sigma2sql.profile import apply_profile, load_profile
+
+rule = load_rule_file("rule.yml")
+target = apply_profile(
+    Target("postgres", "logs.windows", json_column="event"), load_profile("evtx")
+)
+print(to_query(rule, target))
+```
+
+## Development
+
+```bash
+uv sync
+uv run pytest                                               # SQLite and DuckDB
+SIGMA2SQL_PG_DSN=postgresql://postgres:test@localhost/postgres uv run pytest   # + PostgreSQL
+uv run python scripts/check_sigmahq.py sigma/rules --dsn ... [--profile evtx]
+uv run python scripts/check_regression.py sigma
+uv run --with pysigma --with pysigma-backend-sqlite python scripts/diff_pysigma.py sigma
+uv run python scripts/demo_svg.py docs/demo.svg
+```
+
+The behaviour tests in `tests/cases.py` and `tests/test_correlation.py` run unchanged on all
+three databases. The example rules and events in `examples/` were written for this project.
+
+## License
+
+MIT

sigma2sql-0.2.0.dist-info/RECORD

@@ -0,0 +1,25 @@
+sigma2sql/__init__.py,sha256=cpLBs2Y68BYMLVhdEFVkD6tkNH4R6eJkKAC0Kgv8MLk,557
+sigma2sql/__main__.py,sha256=4YSep7LVC8rdeGW9_2icqOpXY1VD5grwCkZQhIGOX68,57
+sigma2sql/cli.py,sha256=BfgHahiMfy1Ln7iBITseev-1vBLkwlm3bude-dodch0,12929
+sigma2sql/collection.py,sha256=TwTumiteM787v-MNUNOe-4Sk6mSfutgVTPKiUaKkF4k,2280
+sigma2sql/condition.py,sha256=pyMqtZjMIElr0H7JJLP9ghJhku5z0jqIJwux_Hnc1-w,3944
+sigma2sql/correlation.py,sha256=4r8KvDMMITbJ6DdiG0Z6BPhWpEP-84MdWy5Lgn_ckDA,3452
+sigma2sql/detection.py,sha256=u3X4Ukq06KvHkNidnhyRZCnsPDrvazSWMUJHr-UB9C8,8832
+sigma2sql/errors.py,sha256=EW7hyckgZU1OL0Rq8RZDOAa_fg0M6M2_eIHZ2Yf6ZKE,184
+sigma2sql/expr.py,sha256=N9anXUvB1eaTg8Gj7YJVDhO9n9qUuHskVO4MdUZSzNw,3046
+sigma2sql/hunt.py,sha256=NWTtZwohfQFY8PvDAndRG8ewXceAJooN5hQ8DK-B1Tc,4341
+sigma2sql/profile.py,sha256=0TFABelU40CQlnkIBPKHG1v1rIeloLqOvbpGv5_IzA0,4597
+sigma2sql/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+sigma2sql/rule.py,sha256=FcOpR5cT7pdNpzg3rpFpM7DFSNICpY5OZ6Csu76Fr5s,9359
+sigma2sql/runner.py,sha256=VHVBVRSPzYbmCW9QA-iXVRErPfoGToGZV8RnMLkzkOg,2743
+sigma2sql/sql.py,sha256=ghJDTI9O-POCsJo9vICyZqKHAIJmcs0QrHtsD9H9IcE,12908
+sigma2sql/profiles/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+sigma2sql/profiles/ecs-winlogbeat.yml,sha256=xtjn6teXEMABcT7GaRAODFmYJWCEe2G1CRQSYwlyYlY,2536
+sigma2sql/profiles/evtx.yml,sha256=wXNuvM4LpBdT7Xv0SAvokcF4nbVfxAOfaYbuOPpMBbs,7878
+sigma2sql/profiles/ocsf.yml,sha256=JvaKI-NcNKJ6q0jivGKoO4I-hcnjmO-IQC2lKKp9qKk,979
+sigma2sql/profiles/sysmon.yml,sha256=Cs63B2YAf1A3baCKKmUQR_p3z32-eE_w1x8gvQXa9lE,2018
+sigma2sql-0.2.0.dist-info/METADATA,sha256=VlvZeBnDvSwz_ydvgT8M-yBVvbEVX21_JuAWv0R3BL4,11776
+sigma2sql-0.2.0.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+sigma2sql-0.2.0.dist-info/entry_points.txt,sha256=CHAbeSFOiT1CGdNGjg6mjkOQ0EhV-OA5eLbhN7NqJ14,49
+sigma2sql-0.2.0.dist-info/licenses/LICENSE,sha256=b3DflAVYTRz4ASbtAXIgB1cgVgkOOahMwfw7Zxi-g7A,1074
+sigma2sql-0.2.0.dist-info/RECORD,,

sigma2sql-0.2.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.33.0
+Root-Is-Purelib: true
+Tag: py3-none-any

sigma2sql-0.2.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+sigma2sql = sigma2sql.cli:main

sigma2sql-0.2.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ahmet Burak Özer
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.