Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions sigma/1.0.0/requirements.txt
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
requests==2.32.4
sigmatools==0.20
shuffle-sdk==0.0.40
17 changes: 9 additions & 8 deletions sigma/1.0.0/src/app.py
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,8 @@
import json
import subprocess

from walkoff_app_sdk.app_base import AppBase
# from walkoff_app_sdk.app_base import AppBase
from shuffle_sdk import AppBase

# Make file sample with namespace yara:
## curl http://localhost:5001/api/v1/files/create -H "Authorization: Bearer 09627dcb-7e2a-4843-819b-417d268ff840" -d '{"filename": "HelloWorld.yml", "org_id": "11f67b76-6051-4425-b0d6-be23daac6d12", "workflow_id": "global", "namespace": "sigma"}'
Expand All @@ -15,7 +16,7 @@
# 2. Add a way to choose the rule and the target platform for it
# 3. Add the possibility of translating rules back and forth

# 4. Make it so you can start with Mitre Att&ck techniques
# 4. Make it so you can start with Mitre Att&ck techniques
# and automatically get the right rules set up with your tools :O
class Sigma(AppBase):
__version__ = "1.0.0"
Expand Down Expand Up @@ -52,19 +53,19 @@ def get_searches(self, engine, backend, shuffle_namespace):
self.logger.info(f"Dir: {os.listdir(basedir)}")

rule = shuffle_namespace
#filename = "file.yaml"
#filename = "file.yaml"
#with open(filename, "w+") as tmp:
# tmp.write(rule)

code = "sigmac --target=%s" % engine
#if len(backend) > 0:
if backend:
if "list" in backend:
code += "--list"
else:
code += " -c %s" % backend
code += " rules/*"

code += " rules/*"
self.logger.info("Code: ", code)
print(code)
print()
Expand All @@ -83,13 +84,13 @@ def get_searches(self, engine, backend, shuffle_namespace):
else:
print("FAILED to run bash: ", stdout[1])
item = stdout[1]

try:
ret = item.decode("utf-8")
return ret
except Exception:
return item

return item

if __name__ == "__main__":
Expand Down
Loading