First Commit

detections/tests/sigma_backends/run.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+#
+# Reproducible backend-portability test for the ARTEX Sigma rules (../../sigma/).
+# The rule README claims the rules "convert to your own SIEM or EDR query
+# language" and lists several supported targets. The base Sigma test (../sigma/)
+# only exercises Splunk; this test turns the cross-backend claim into something a
+# reviewer can re-run, and keeps the README's per-backend guidance honest.
+#
+# It proves two properties with no host dependency beyond Docker (sigma-cli and
+# its backends run in a container, nothing is installed on the host and nothing
+# is written to the repo tree):
+#
+#   1. correlations are portable    the whole tree converts on splunk, the
+#                                   Elasticsearch eql target, and Grafana loki
+#   2. the atomic-only fallback     the five atomic rules convert on lucene and
+#      works                        kusto (Microsoft Sentinel / Defender), which
+#                                   do not support Sigma correlation conversion
+#
+# See ../README.md "Sigma backend portability" for the measured support matrix
+# and the exact per-backend commands this test reproduces.
+#
+# Usage:   detections/tests/sigma_backends/run.sh
+# Env:     PYTHON_IMAGE      (default python:3.12-slim)
+#          SIGMA_CLI_VERSION (default 3.1.0 — the pinned reference version)
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+REPO="$(cd "$HERE/../../.." && pwd)"
+SIGMA_DIR="$REPO/detections/sigma"
+PYTHON_IMAGE="${PYTHON_IMAGE:-python:3.12-slim}"
+SIGMA_CLI_VERSION="${SIGMA_CLI_VERSION:-3.1.0}"
+
+# Everything runs inside the container: check.sh installs the pinned sigma-cli and
+# four backends, then asserts the two properties and exits non-zero on any
+# failure. The rule tree and this directory are mounted read-only.
+docker run --rm \
+  -v "$SIGMA_DIR:/sigma:ro" \
+  -v "$HERE:/src:ro" \
+  -e SIGMA_CLI_VERSION="$SIGMA_CLI_VERSION" \
+  "$PYTHON_IMAGE" sh /src/check.sh