dela
0335d572de
ci / go (push) Waiting to run
ci / go-db (agent) (push) Waiting to run
ci / go-db (config) (push) Waiting to run
ci / go-db (db) (push) Waiting to run
ci / go-db (evidence) (push) Waiting to run
ci / go-db (llmrec) (push) Waiting to run
ci / go-db (server) (push) Waiting to run
web / web (push) Waiting to run
docs / links (push) Canceled after 0s
detections / detections (push) Canceled after 0s
41 lines
1.9 KiB
Bash
Executable File
41 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Reproducible backend-portability test for the ARTEX Sigma rules (../../sigma/).
|
|
# The rule README claims the rules "convert to your own SIEM or EDR query
|
|
# language" and lists several supported targets. The base Sigma test (../sigma/)
|
|
# only exercises Splunk; this test turns the cross-backend claim into something a
|
|
# reviewer can re-run, and keeps the README's per-backend guidance honest.
|
|
#
|
|
# It proves two properties with no host dependency beyond Docker (sigma-cli and
|
|
# its backends run in a container, nothing is installed on the host and nothing
|
|
# is written to the repo tree):
|
|
#
|
|
# 1. correlations are portable the whole tree converts on splunk, the
|
|
# Elasticsearch eql target, and Grafana loki
|
|
# 2. the atomic-only fallback the five atomic rules convert on lucene and
|
|
# works kusto (Microsoft Sentinel / Defender), which
|
|
# do not support Sigma correlation conversion
|
|
#
|
|
# See ../README.md "Sigma backend portability" for the measured support matrix
|
|
# and the exact per-backend commands this test reproduces.
|
|
#
|
|
# Usage: detections/tests/sigma_backends/run.sh
|
|
# Env: PYTHON_IMAGE (default python:3.12-slim)
|
|
# SIGMA_CLI_VERSION (default 3.1.0 — the pinned reference version)
|
|
set -euo pipefail
|
|
|
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
|
REPO="$(cd "$HERE/../../.." && pwd)"
|
|
SIGMA_DIR="$REPO/detections/sigma"
|
|
PYTHON_IMAGE="${PYTHON_IMAGE:-python:3.12-slim}"
|
|
SIGMA_CLI_VERSION="${SIGMA_CLI_VERSION:-3.1.0}"
|
|
|
|
# Everything runs inside the container: check.sh installs the pinned sigma-cli and
|
|
# four backends, then asserts the two properties and exits non-zero on any
|
|
# failure. The rule tree and this directory are mounted read-only.
|
|
docker run --rm \
|
|
-v "$SIGMA_DIR:/sigma:ro" \
|
|
-v "$HERE:/src:ro" \
|
|
-e SIGMA_CLI_VERSION="$SIGMA_CLI_VERSION" \
|
|
"$PYTHON_IMAGE" sh /src/check.sh
|