Skip to content

Commit

Permalink
make output a little easier to read
Browse files Browse the repository at this point in the history
  • Loading branch information
YamatoSecurity committed Jan 18, 2024
1 parent dfd3664 commit 84391f7
Showing 1 changed file with 6 additions and 6 deletions.
12 changes: 6 additions & 6 deletions tools/sigmac/logsource_mapping.py
Original file line number Diff line number Diff line change
Expand Up @@ -248,14 +248,14 @@ def get_logsources(self, obj: dict) -> list[LogSource]:
logsources = self.logsource_map.get(obj['logsource']['service'])
if logsources:
return logsources
msg = f"This rule inconvertible service:[{obj['logsource']['service']}]. Skip conversion."
msg = f"This rule inconvertible service:[{obj['logsource']['service']}]. Conversion skipped."
raise Exception(msg)
elif 'category' in obj['logsource']:
category = obj['logsource']['category']
logsources = self.logsource_map.get(category)
if logsources:
return logsources
msg = f"This rule has inconvertible service:[{category}]. Skip conversion."
msg = f"This rule has inconvertible service: [{category}]. Conversion skipped."
raise Exception(msg)
return []

Expand All @@ -267,7 +267,7 @@ def convert(self):
keys = get_terminal_keys_recursive(obj["detection"], [])
modifiers = {re.sub(r".*\|", "", k) for k in keys if "|" in k}
if modifiers and [m for m in modifiers if m not in ["all", "base64", "base64offset", "cidr", "contains", "endswith", "endswithfield", "equalsfield", "re", "startswith"]]:
LOGGER.error(f"This rule has incompatible field.{obj['detection']}. skip conversion.")
LOGGER.error(f"This rule has incompatible field: {obj['detection']}. Conversion skipped.")
return
logsources = self.get_logsources(obj)
if not logsources:
Expand Down Expand Up @@ -296,7 +296,7 @@ def convert(self):
val = self.transform_field_recursive(ls.category, val, ls.need_field_conversion())
new_obj['detection'][key] = val
if " of " not in new_obj['detection']['condition'] and not ls.is_detectable(new_obj['detection']):
LOGGER.error(f"Error while converting rule [{self.sigma_path}]: This rule has incompatible field.{new_obj['detection']}. skip conversion.")
LOGGER.error(f"Error while converting rule [{self.sigma_path}]: This rule has incompatible field: {new_obj['detection']}. Conversion skipped.")
return
field_map = self.field_map[ls.category] if ls.category in self.field_map else dict()
new_obj['detection']['condition'] = ls.get_condition(new_obj['detection']['condition'],
Expand All @@ -310,7 +310,7 @@ def convert(self):
condition_str = new_obj['detection']['condition']
if '%' in condition_str or '->' in condition_str:
LOGGER.error(
f"Error while converting rule [{self.sigma_path}]: Invalid character in condition [{condition_str}] file [{self.sigma_path}]. Skip conversion.")
f"Error while converting rule [{self.sigma_path}]: Invalid character in condition [{condition_str}] file [{self.sigma_path}]. Conversion skipped.")
continue # conditionブロックに変な文字が入っているルールがある。この場合スキップ
if ls.service == "sysmon":
self.sigma_converted.append((True, new_obj))
Expand Down Expand Up @@ -450,7 +450,7 @@ def find_windows_sigma_rule_files(root: str, rule_pattern: str):
data = yaml.safe_load(f)
if data.get('logsource', {}).get('category') != "antivirus" \
and data.get('logsource', {}).get('product') != 'windows':
LOGGER.debug(f"[{filepath}] has no windows rule. skip conversion.")
LOGGER.debug(f"[{filepath}] has no windows rule. Conversion skipped.")
else:
yield filepath
except Exception as e:
Expand Down

0 comments on commit 84391f7

Please sign in to comment.