valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 17:35:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Adding support for reading sigma rule from stdin in sigmac

Browse Source
This commit is contained in:
Michael H 2018-10-07 10:11:47 -05:00
parent aabaa0257b
commit bbb67fbba4
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
tools/sigmac
View File

@ -54,6 +54,9 @@ def alliter(path):
yield sub
def get_inputs(paths, recursive):
if paths == ['-']:
return [sys.stdin]
if recursive:
return list(itertools.chain.from_iterable([list(alliter(pathlib.Path(p))) for p in paths]))
else:
@ -91,7 +94,7 @@ argparser.add_argument("--defer-abort", "-d", action="store_true", help="Don't a
argparser.add_argument("--ignore-backend-errors", "-I", action="store_true", help="Only return error codes for parse errors and ignore errors for rules that cause backend errors. Useful, when you want to get as much queries as possible.")
argparser.add_argument("--verbose", "-v", action="store_true", help="Be verbose")
argparser.add_argument("--debug", "-D", action="store_true", help="Debugging output")
argparser.add_argument("inputs", nargs="*", help="Sigma input files")
argparser.add_argument("inputs", nargs="*", help="Sigma input files ('-' for stdin)")
cmdargs = argparser.parse_args()
if cmdargs.debug:
@ -146,7 +149,10 @@ error = 0
for sigmafile in get_inputs(cmdargs.inputs, cmdargs.recurse):
print_verbose("* Processing Sigma input %s" % (sigmafile))
try:
f = sigmafile.open(encoding='utf-8')
if cmdargs.inputs == ['-']:
f = sigmafile
else:
f = sigmafile.open(encoding='utf-8')
parser = SigmaCollectionParser(f, sigmaconfig, rulefilter)
results = parser.generate(backend)
for result in results: