2019-12-20 22:53:22 +01:00
.PHONY : test test -rules test -sigmac test -sigma 2attack
2018-10-02 22:17:03 +02:00
TMPOUT = $( shell tempfile|| mktemp)
2019-12-20 22:53:22 +01:00
COVSCOPE = tools/sigma/*.py,tools/sigma/backends/*.py,tools/sigmac,tools/merge_sigma,tools/sigma2attack
2019-10-23 15:34:40 +02:00
export COVERAGE = coverage
2020-05-30 00:56:06 +02:00
test : clearcov test -rules test -sigmac test -merge test -sigma 2attack build finish
2017-11-14 22:17:18 +01:00
clearcov :
rm -f .coverage
finish :
2020-10-23 20:17:06 +02:00
$( COVERAGE) report --fail-under= 80
2017-11-14 22:17:18 +01:00
rm -f $( TMPOUT)
2017-08-07 14:05:55 +02:00
2019-01-23 23:31:36 +01:00
test-rules :
2017-10-19 17:42:56 +02:00
yamllint rules
2019-01-23 23:31:36 +01:00
tests/test_rules.py
2020-03-31 16:29:58 +02:00
tools/sigma_uuid -Ver rules/
2017-08-07 14:05:55 +02:00
test-sigmac :
2019-10-23 15:34:40 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -h
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -l
2020-06-06 00:49:57 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac --backend-help es-qs
2019-10-23 15:34:40 +02:00
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvd -t es-qs rules/ > /dev/null
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t es-qs rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t es-qs --shoot-yourself-in-the-foot rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t es-qs -c winlogbeat tests/test-modifiers.yml > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -O rulecomment -rvdI -c tools/config/winlogbeat.yml -t es-qs rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t kibana -c tools/config/winlogbeat.yml rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t graylog rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t xpack-watcher -O email,index,webhook -c tools/config/winlogbeat.yml rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t elastalert -c tools/config/winlogbeat.yml -O alert_methods = http_post,email -O emails = test@test.invalid -O http_post_url = http://test.invalid rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t elastalert-dsl -c tools/config/winlogbeat.yml -O alert_methods = http_post,email -O emails = test@test.invalid -O http_post_url = http://test.invalid rules/ > /dev/null
2020-05-08 17:51:35 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t ee-outliers -c tools/config/winlogbeat.yml rules/ > /dev/null
2020-06-13 01:11:08 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t es-qs -c sysmon -c winlogbeat -O case_insensitive_whitelist = * rules/windows/process_creation > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t es-qs -c tools/config/ecs-cloudtrail.yml rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t es-rule -c tools/config/ecs-cloudtrail.yml rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t kibana -c tools/config/ecs-cloudtrail.yml rules/ > /dev/null
2020-05-14 14:03:23 +01:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t xpack-watcher -c tools/config/ecs-cloudtrail.yml rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t elastalert -c tools/config/ecs-cloudtrail.yml rules/ > /dev/null
2020-11-01 21:28:26 -03:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t es-qs -c tools/config/ecs-suricata.yml rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t es-rule -c tools/config/ecs-suricata.yml rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t kibana -c tools/config/ecs-suricata.yml rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t xpack-watcher -c tools/config/ecs-suricata.yml rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t elastalert -c tools/config/ecs-suricata.yml rules/ > /dev/null
2019-10-23 15:34:40 +02:00
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t splunk rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t splunk -c tools/config/splunk-windows-index.yml rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t splunkxml -c tools/config/splunk-windows.yml rules/ > /dev/null
2021-07-10 22:23:15 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t splunkdm -c tools/config/splunk-windows.yml rules/ > /dev/null
2019-10-23 15:34:40 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t logpoint -c tools/config/logpoint-windows.yml rules/ > /dev/null
2021-08-29 11:47:47 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t devo -c tools/config/devo-windows.yml rules/ > /dev/null
2021-08-29 09:24:43 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t lacework rules/ > /dev/null
2020-05-02 14:22:03 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t mdatp rules/ > /dev/null
2021-08-29 12:19:49 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t uberagent rules/ > /dev/null
2021-10-26 19:37:22 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t athena -c tools/config/athena.yml rules/ > /dev/null
2019-10-23 15:34:40 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t ala rules/ > /dev/null
2020-05-02 14:22:03 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t ala-rule rules/ > /dev/null
2019-10-23 15:34:40 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t ala --backend-config tests/backend_config.yml rules/windows/process_creation/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t es-dsl -c tools/config/winlogbeat.yml rules/ > /dev/null
2020-05-02 14:22:03 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t es-rule -c tools/config/winlogbeat.yml rules/ > /dev/null
2019-10-23 15:34:40 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t powershell -c tools/config/powershell.yml -Ocsv rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t arcsight -c tools/config/arcsight.yml rules/ > /dev/null
2020-05-02 14:22:03 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t arcsight-esm -c tools/config/arcsight.yml rules/ > /dev/null
2019-10-23 15:34:40 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t qradar -c tools/config/qradar.yml rules/ > /dev/null
2021-02-08 12:23:57 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t stix -c tools/config/stix-custom.yml -c tools/config/stix-shifter.yml -c tools/config/stix2.0.yml rules/ > /dev/null
2020-05-02 14:22:03 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t limacharlie -c tools/config/limacharlie.yml rules/ > /dev/null
2021-03-12 12:21:44 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t chronicle -c tools/config/chronicle.yml rules/ > /dev/null
2020-05-02 14:22:03 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t carbonblack -c tools/config/carbon-black.yml rules/ > /dev/null
2019-10-23 15:34:40 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t qualys -c tools/config/qualys.yml rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t netwitness -c tools/config/netwitness.yml rules/ > /dev/null
2020-09-15 09:06:02 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t netwitness-epl -c netwitness-epl rules/ > /dev/null
2019-10-23 15:34:40 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t sumologic -O rulecomment -c tools/config/sumologic.yml rules/ > /dev/null
2020-10-23 19:30:59 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t sumologic-cse -O rulecomment -c tools/config/sumologic-cse.yml rules/ > /dev/null
2020-05-24 21:46:55 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t humio -O rulecomment -c tools/config/humio.yml rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t crowdstrike -O rulecomment -c tools/config/crowdstrike.yml rules/ > /dev/null
2020-05-02 14:22:03 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t sql -c sysmon rules/ > /dev/null
2020-05-25 10:54:16 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t sqlite -c sysmon rules/ > /dev/null
2020-07-07 23:46:49 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t csharp -c sysmon rules/ > /dev/null
2020-05-02 14:22:03 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t logiq -c sysmon rules/ > /dev/null
2020-10-27 14:02:00 -04:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t fireeye-helix -c tools/config/fireeye-helix.yml rules/ > /dev/null
2020-09-15 12:20:46 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t sysmon -c sysmon -rvd rules/windows/driver_load rules/windows/file_event rules/windows/image_load rules/windows/network_connection rules/windows/process_access rules/windows/process_creation rules/windows/registry_event rules/windows/sysmon > /dev/null
2019-10-23 15:34:40 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t splunk -c tools/config/splunk-windows-index.yml -f 'level>=high,level<=critical,status=stable,logsource=windows,tag=attack.execution' rules/ > /dev/null
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t splunk -c tools/config/splunk-windows-index.yml -f 'level>=high,level<=critical,status=xstable,logsource=windows' rules/ > /dev/null
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t splunk -c tools/config/splunk-windows-index.yml -f 'level>=high,level<=xcritical,status=stable,logsource=windows' rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t splunk -c tools/config/splunk-windows-index.yml -f 'level=critical' rules/ > /dev/null
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t splunk -c tools/config/splunk-windows-index.yml -f 'level=xcritical' rules/ > /dev/null
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t splunk -c tools/config/splunk-windows-index.yml -f 'foo=bar' rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-windows.yml -t es-qs rules/ > /dev/null
2020-05-02 14:22:03 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -c ecs-proxy -t es-qs rules/proxy > /dev/null
2019-10-23 15:34:40 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -c sysmon -c logstash-windows -t es-qs rules/ > /dev/null
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -c sysmon -c logstash-windows -t splunk rules/ > /dev/null
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-windows.yml -c tools/config/generic/sysmon.yml -t es-qs rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-linux.yml -t es-qs rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-windows.yml -t kibana rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-windows.yml -Ooutput= curl -t kibana rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-linux.yml -t kibana rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-linux.yml -Ooutput= curl -t kibana rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-windows.yml -t xpack-watcher rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -c tools/config/logstash-linux.yml -t xpack-watcher rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -c tools/config/filebeat-defaultindex.yml -t xpack-watcher rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -c tools/config/splunk-windows.yml -t splunk rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -c tools/config/generic/sysmon.yml -c tools/config/splunk-windows.yml -t splunk rules/ > /dev/null
2021-10-26 20:26:29 +00:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -c tools/config/hawk.yml -t hawk rules/ > /dev/null
2019-10-23 15:34:40 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t grep rules/ > /dev/null
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -rvdI -t fieldlist rules/ > /dev/null
2021-12-04 10:59:24 +01:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t xpack-watcher -c tools/config/winlogbeat.yml -O output = plain -O es = es -O foobar rules/windows/builtin/security/win_susp_failed_logons_single_source.yml > /dev/null
2019-10-23 15:34:40 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t kibana -c tests/config-multiple_mapping.yml -c tests/config-multiple_mapping-2.yml tests/mapping-conditional-multi.yml > /dev/null
2021-12-04 10:59:24 +01:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t xpack-watcher -c tools/config/winlogbeat.yml -O output = json -O es = es -O foobar rules/windows/builtin/security/win_susp_failed_logons_single_source.yml > /dev/null
2019-10-23 15:34:40 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml -o $( TMPOUT) - < tests/collection_repeat.yml > /dev/null
2021-12-04 10:59:24 +01:00
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t xpack-watcher -c tools/config/winlogbeat.yml -O output = foobar -O es = es -O foobar rules/windows/builtin/security/win_susp_failed_logons_single_source.yml > /dev/null
2019-10-23 15:34:40 +02:00
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml tests/not_existing.yml > /dev/null
2021-07-26 16:26:03 -04:00
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml tests/invalid_yaml.badyml > /dev/null
2019-10-23 15:34:40 +02:00
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml tests/invalid_sigma-no_identifiers.yml > /dev/null
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml tests/invalid_sigma-no_condition.yml > /dev/null
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml tests/invalid_sigma-invalid_identifier_reference.yml > /dev/null
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml tests/invalid_sigma-invalid_aggregation.yml > /dev/null
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml tests/invalid_sigma-wrong_identifier_definition.yml > /dev/null
2021-12-04 10:59:24 +01:00
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml rules/windows/builtin/security/win_susp_failed_logons_single_source.yml
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t es-qs -c tools/config/winlogbeat.yml -o /not_possible rules/windows/deprecated/sysmon_mimikatz_detection_lsass.yml
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t es-qs -c not_existing rules/windows/deprecated/sysmon_mimikatz_detection_lsass.yml
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t es-qs -c tests/invalid_yaml.badyml rules/windows/deprecated/sysmon_mimikatz_detection_lsass.yml
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/sigmac -t es-qs -c tests/invalid_config.yml rules/windows/deprecated/sysmon_mimikatz_detection_lsass.yml
2017-11-14 22:17:18 +01:00
test-merge :
tests/test-merge.sh
2019-10-23 15:34:40 +02:00
! $( COVERAGE) run -a --include= $( COVSCOPE) tools/merge_sigma tests/not_existing.yml > /dev/null
2017-12-08 00:44:15 +01:00
2018-04-03 23:02:40 +02:00
test-backend-es-qs :
2018-04-11 23:25:50 +02:00
tests/test-backend-es-qs.py
2018-04-03 23:02:40 +02:00
2020-05-29 23:56:05 +02:00
test-backend-sql :
2020-05-30 00:56:06 +02:00
cd tools && python3 setup.py install
2020-05-30 01:57:06 +02:00
cd tools && $( COVERAGE) run -m pytest tests/test_backend_sql.py tests/test_backend_sqlite.py
2020-05-29 23:56:05 +02:00
2019-12-20 22:53:22 +01:00
test-sigma2attack :
2020-05-02 14:22:03 +02:00
$( COVERAGE) run -a --include= $( COVSCOPE) tools/sigma2attack
2019-12-20 22:53:22 +01:00
2020-03-31 23:46:58 +02:00
build : tools /sigma /*.py tools /setup .py tools /setup .cfg
2019-12-06 15:45:28 +01:00
cd tools && python3 setup.py bdist_wheel sdist
2017-12-08 22:54:40 +01:00
2017-12-08 23:50:08 +01:00
upload-test : build
twine upload --repository-url https://test.pypi.org/legacy/ tools/dist/*
upload : build
twine upload tools/dist/*
2017-12-08 22:54:40 +01:00
clean :
cd tools; rm -fr build dist Sigma.egg-info
find tools/ -type d -name __pycache__ -exec rm -fr { } \;