Support for reading rules from standard input

[ali-saad-jaffer]

Hi,

Are there any plans to add support for reading rules from standard input?

I have a wrapper built in nodejs that is currently using sigmac for rule conversion

[signus]

I'm unsure of the roadmap of the project, but this can be a potential enhancement.

I would assume this would be for both the check and convert commands? It would be useful to provide examples of expected function when submitting an issue. A wrapper in NodeJS provides an example of how people are currently utilizing sigmac, but not how stdin is currently being used.

Checking the current functionality with some debug print statements:

check stdin can be passed, but is not processed by the click() option.

(sigma-cli-py3.11) ❯❯❯❯ cat rules/windows/process_creation/certutil_susp_download.yml | sigma check                                                                                                          
DEBUG: input: ()
Parsing Sigma rules  [####################################]  100%
Checking Sigma rules  [####################################]  100%

=== Summary ===
Found 0 errors, 0 condition errors and 0 issues.
No rule errors found.
No condition errors found.
No validation issues found.

convert does not process with a stdin path piped to it.

[thomaspatzke]

Hi!

Are there any plans to add support for reading rules from standard input?

At least it's not on my todo list, but feel free to implement 😉

Click by itself supports this behavior, but I've chosen a different path because usually a directory is given to the CLI with the intention to convert its whole content. The load_rules() function implements the file path handling

[signus]

Thanks @thomaspatzke, I'll take a shot at this one and add some notes.

Notably it appears that some modifications will have to be made where both the input or the stdin Path can be a single file or the directory path for the rules, as presently specifying a single rule file processes normally even though it should fail the check.

[thomaspatzke]

Implemented! It will be contained in the next release.

[signus]

Man, you're quick! Do you classify as human? :D

Thank you for your work!

[ali-saad-jaffer]

Thanks @thomaspatzke

[thomaspatzke]

Just released in v0.7.3