diff --git a/Makefile b/Makefile index 5b2c7f173..e4968975a 100644 --- a/Makefile +++ b/Makefile @@ -110,7 +110,7 @@ test-backend-es-qs: test-backend-sql: cd tools && python3 setup.py install - cd tools && python3 -m pytest tests/test_backend_sql.py tests/test_backend_sqlite.py + cd tools && $(COVERAGE) run -m pytest tests/test_backend_sql.py tests/test_backend_sqlite.py test-sigma2attack: $(COVERAGE) run -a --include=$(COVSCOPE) tools/sigma2attack diff --git a/tools/sigma/backends/sql.py b/tools/sigma/backends/sql.py index 7ea27c76f..5b446a6f3 100644 --- a/tools/sigma/backends/sql.py +++ b/tools/sigma/backends/sql.py @@ -178,7 +178,7 @@ class SQLBackend(SingleTextQueryBackend): def generateQuery(self, parsed): if self._recursiveFtsSearch(parsed.parsedSearch): - raise NotImplementedError("FullTextSearch not implemented for SQL Backend, use SQLite Backend.") + raise NotImplementedError("FullTextSearch not implemented for SQL Backend.") result = self.generateNode(parsed.parsedSearch) if parsed.parsedAgg: diff --git a/tools/sigma/backends/sqlite.py b/tools/sigma/backends/sqlite.py index f29b0eb2d..8eec13ea7 100644 --- a/tools/sigma/backends/sqlite.py +++ b/tools/sigma/backends/sqlite.py @@ -20,7 +20,7 @@ import re class SQLiteBackend(SQLBackend): - """SQLiteBackend provides FullTextSearch functionality""" + """Converts Sigma rule into SQL query for SQLite""" identifier = "sqlite" active = True @@ -121,20 +121,3 @@ class SQLiteBackend(SQLBackend): return "SELECT * FROM {} WHERE {}".format(fro, whe) return "SELECT * FROM {} WHERE {}".format(self.table, result) - - def generateFullTextQuery(self, search, parsed): - - search = search.replace('"', '') - search = '" OR "'.join(search.split(" OR ")) - search = '" AND "'.join(search.split(" AND ")) - search = '"{}"'.format(search) - search = search.replace('%', '') - search = search.replace('_', '') - search = '{} MATCH (\'{}\')'.format(self.table, search) - - if parsed.parsedAgg: - # Handle aggregation - fro, whe = self.generateAggregation(parsed.parsedAgg, search) - return "SELECT * FROM {} WHERE {}".format(fro, whe) - - return 'SELECT * FROM {} WHERE {}'.format(self.table, search) \ No newline at end of file