Merge pull request #576 from Yamato-Security/fix-rule-parse-error-568

fix: rule parse error(regression caused by #568)
Yamato-Security · Jan 21, 2024 · 7d33eff · 7d33eff
2 parents 7fde4ca + d1ca094
commit 7d33eff
Show file tree

Hide file tree

Showing 4,150 changed files with 98 additions and 178,145 deletions.
diff --git a/.github/workflows/update-sigmarule.yaml b/.github/workflows/update-sigmarule.yaml
@@ -40,11 +40,11 @@ jobs:
         run: |
           cd hayabusa-rules/tools/sigmac/
           poetry install --no-root
-          poetry run python logsource_mapping.py -r ../../../sigma-repo -o converted_rules
+          poetry run python logsource_mapping.py -r ../../../sigma-repo -o ../../../converted_rules
           cd -
           rm -rf hayabusa-rules/sigma/
           mkdir hayabusa-rules/sigma/
-          cp -r hayabusa-rules/tools/sigmac/converted_rules/* hayabusa-rules/sigma/
+          cp -r converted_rules/* hayabusa-rules/sigma/
 
       - name: Create Text
         id: create-text

diff --git a/CHANGELOG-Japanese.md b/CHANGELOG-Japanese.md
@@ -2,7 +2,6 @@
 
 ## v2.13.0-dev [2024/01/19]
 
-Sigmaルールのコメントを残すようにした。以前は変換後に削除されていた。(#568) (@fukusuket)
 Sigma変換バックエンドのパッケージ管理は [Poetry](https://python-poetry.org/) 、静的コード分析は [Ruff](https://github.com/astral-sh/ruff) で実行するようにした。(#567) (@fukusuket)
 
 ## v2.12.0 [2023/12/19]

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,7 +2,6 @@
 
 ## v2.13.0-dev [2024/01/19]
 
-Comments in Sigma rules are left as is. Before, they would be stripped after conversion. (#568) (@fukusuket)
 Package management for the sigma conversion backend is now handled by [Poetry](https://python-poetry.org/) and static code analysis is performed by [Ruff](https://github.com/astral-sh/ruff). (#567) (@fukusuket)
 
 ## v2.12.0 [2023/12/19]

diff --git a/tools/sigmac/converted_rules/builtin/application/Other/win_av_relevant_match.yml b/tools/sigmac/converted_rules/builtin/application/Other/win_av_relevant_match.yml
diff --git a/...erted_rules/builtin/application/application_error/win_application_msmpeng_crash_error.yml b/...erted_rules/builtin/application/application_error/win_application_msmpeng_crash_error.yml
diff --git a/...d_rules/builtin/application/application_error/win_werfault_susp_lsass_credential_dump.yml b/...d_rules/builtin/application/application_error/win_werfault_susp_lsass_credential_dump.yml
diff --git a/tools/sigmac/converted_rules/builtin/application/esent/win_esent_ntdsutil_abuse.yml b/tools/sigmac/converted_rules/builtin/application/esent/win_esent_ntdsutil_abuse.yml
diff --git a/...gmac/converted_rules/builtin/application/esent/win_esent_ntdsutil_abuse_susp_location.yml b/...gmac/converted_rules/builtin/application/esent/win_esent_ntdsutil_abuse_susp_location.yml
diff --git a/.../sigmac/converted_rules/builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml b/.../sigmac/converted_rules/builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml
diff --git a/...c/converted_rules/builtin/application/microsoft_windows_backup/win_susp_backup_delete.yml b/...c/converted_rules/builtin/application/microsoft_windows_backup/win_susp_backup_delete.yml
diff --git a/...crosoft_windows_software_restriction_policies/win_software_restriction_policies_block.yml b/...crosoft_windows_software_restriction_policies/win_software_restriction_policies_block.yml