fix: rule parse error(regression caused by #568)

[fukusuket]

What Changed

• fixed Rule parsing error due to regression (caused by #568) #575
  • removed unneeded main/tools/sigmac/converted_rules rule files. (This folder was also accidentally committed🙇)
  • revert feat: keep yaml comment as is #568 feature

Evidence

Test Environment

• OS: macOS Sonoma version 14.0
• Hard: MacBook Air(M1, 2020) , Memory 8GB, Core 8
• Poetry: version 1.7.1

conversion script

I confirmed that logsource_mapping.py works as shown below.

% poetry run python logsource_mapping.py -r ../../../sigma -o ./converted_sigma_rules
[INFO:logsource_mapping.py:462] Start to logsource mapping sigma rules.
...
[INFO:logsource_mapping.py:520] [4111] files created successfully. Created files were saved under [./converted_sigma_rules].
[INFO:logsource_mapping.py:521] Script took [10.78] seconds.
fukusuke@fukusukenoMacBook-Air sigmac % 

no conversion errors

I confirmed that no parse errors as shown below.

% ./hayabusa csv-timeline -d ../hayabusa-sample-evtx -r ~/Scripts/Python/hayabusa-rules/tools/sigmac/converted_sigma_rules -w -o out.csv -C

╔╗ ╔╦═══╦╗  ╔╦═══╦══╗╔╗ ╔╦═══╦═══╗
║║ ║║╔═╗║╚╗╔╝║╔═╗║╔╗║║║ ║║╔═╗║╔═╗║
║╚═╝║║ ║╠╗╚╝╔╣║ ║║╚╝╚╣║ ║║╚══╣║ ║║
║╔═╗║╚═╝║╚╗╔╝║╚═╝║╔═╗║║ ║╠══╗║╚═╝║
║║ ║║╔═╗║ ║║ ║╔═╗║╚═╝║╚═╝║╚═╝║╔═╗║
╚╝ ╚╩╝ ╚╝ ╚╝ ╚╝ ╚╩═══╩═══╩═══╩╝ ╚╝
   by Yamato Security

Start time: 2024/01/21 13:53

Total event log files: 583
Total file size: 137.1 MB

Loading detection rules. Please wait.

Excluded rules: 27

Deprecated rules: 187 (4.85%) (Disabled)
Experimental rules: 1418 (36.81%)
Stable rules: 108 (2.80%)
Test rules: 2326 (60.38%)
Unsupported rules: 45 (1.17%) (Disabled)

Sigma rules: 3852
Total enabled detection rules: 3852

I would appreciate it if you could review when you have time🙏

[fukusuket]

I fixed regression in #568. I am very sorry ... :(
The workflow Rule parse error check failure is caused by #568, so please ignore it in this PR🙇

[YamatoSecurity]

@fukusuket Thank you for the quick fix!

[fukusuket]

@YamatoSecurity
Thank you so much for quick merging🙇
The GitHub Actions rule checks were not executed when Auto-PR(It was executed only manual PR) ... so check them as well.

• feat: add rule parse error check GitHub Actions #547