First Commit

detections/tests/sigma_lint/check.sh

@@ -0,0 +1,85 @@
+#!/bin/sh
+#
+# In-container half of the ARTEX Sigma SigmaHQ-convention lint test. run.sh
+# launches this inside a Python container with the Sigma rule tree mounted
+# read-only at /sigma and this directory at /src. It installs a pinned sigma-cli
+# plus the pinned SigmaHQ validator plugin, then asserts two properties:
+#
+#   1. baseline is clean    sigma check with the documented validators.yml
+#                           baseline reports 0 errors and 0 issues.
+#   2. the full set is live  running ALL SigmaHQ validators (no exclusions) still
+#                           reports issues, and every issue type is one of the
+#                           four documented, excluded categories — nothing else.
+#
+# Property 2 is the anti-vacuity guard. If the validator plugin failed to load,
+# the "all" run would report zero issues and property 1 would pass vacuously;
+# requiring the known exclusions to appear proves the full SigmaHQ set actually
+# ran. It also fails the build the moment a rule picks up a NEW convention issue
+# outside the documented baseline (e.g. a mis-cased title or an invalid field),
+# because that issue type would not be in the allow-list below and property 1
+# would stop being clean.
+#
+# POSIX sh (the slim image ships dash). Exits non-zero if any assertion fails.
+set -eu
+
+VERSION="${SIGMA_CLI_VERSION:-3.1.0}"
+SIGMAHQ_VALIDATORS_VERSION="${SIGMAHQ_VALIDATORS_VERSION:-0.21.0}"
+
+pip install --quiet --disable-pip-version-check \
+  "sigma-cli==${VERSION}" "pySigma-validators-sigmahq==${SIGMAHQ_VALIDATORS_VERSION}" >/dev/null 2>&1
+
+# The four issue types the documented baseline (validators.yml) intentionally
+# excludes. Any issue outside this set must fail the build.
+ALLOWED='SigmahqGithubLinkIssue SigmahqFilenamePrefixIssue SigmahqCorrelationFilenamePrefixIssue SigmahqLogsourceUnknownIssue'
+
+printf 'validators:\n  - all\n' > /tmp/all.yml
+
+fail=0
+note() { printf '  %s\n' "$1"; }
+pass() { note "PASS  $1"; }
+bad()  { note "FAIL  $1"; fail=1; }
+
+echo "== 1/2  documented SigmaHQ baseline is clean (validators.yml) =="
+if base_out="$(sigma check --validation-config /src/validators.yml /sigma 2>&1)" \
+   && printf '%s' "$base_out" | grep -q 'Found 0 errors, 0 condition errors and 0 issues'; then
+  pass "sigma check with the documented baseline: 0 errors, 0 issues"
+else
+  bad  "the documented baseline reported problems (a non-excluded convention issue, or an error)"
+  printf '%s\n' "$base_out" | sed 's/^/        /'
+fi
+
+echo "== 2/2  the full SigmaHQ validator set runs, and only the documented exclusions remain =="
+all_out="$(sigma check --validation-config /tmp/all.yml /sigma 2>&1 || true)"
+# Collect the distinct issue types the full set reports.
+types="$(printf '%s' "$all_out" | grep -oE 'issue=Sigmahq[A-Za-z]+Issue' | sed 's/^issue=//' | sort -u)"
+
+if [ -z "$types" ]; then
+  bad  "the full validator set reported no SigmaHQ issues at all — the plugin did not load (vacuous)"
+else
+  # Anti-vacuity: the two load-bearing exclusions must actually appear.
+  for must in SigmahqGithubLinkIssue SigmahqLogsourceUnknownIssue; do
+    if printf '%s\n' "$types" | grep -qx "$must"; then
+      pass "full set is live: $must present"
+    else
+      bad  "expected $must from the full validator set but it was absent — plugin/version drift"
+    fi
+  done
+  # No issue type outside the documented allow-list may appear.
+  unexpected=0
+  for t in $types; do
+    case " $ALLOWED " in
+      *" $t "*) : ;;
+      *) bad "undocumented convention issue from the full set: $t"; unexpected=1 ;;
+    esac
+  done
+  [ "$unexpected" -eq 0 ] && pass "every reported issue is one of the four documented exclusions"
+fi
+
+echo
+echo "reference: sigma-cli ${VERSION}, pySigma-validators-sigmahq ${SIGMAHQ_VALIDATORS_VERSION}"
+if [ "$fail" -eq 0 ]; then
+  echo "RESULT: PASS"
+else
+  echo "RESULT: FAIL"
+fi
+exit "$fail"