v4.0.0

Breaking Change by Security Hardening: Enhanced Sigma Policy and Safe Defaults

This release introduces comprehensive security hardening through new security policy profiles and safer defaults. The CLI now supports two explicit policies: Safe Policy (default) uses the RE2 regex engine to prevent DoS attacks, disables template variable expansion, and blocks external rule sources—ideal for untrusted rules. Trusted Policy uses Python's native regex engine with broader pattern support and allows template variables and external sources for controlled environments. By default, processing now prioritizes security with RE2 regex, disabled template variables, and blocked external sources.

Users can control security policies through command-line options: use --policy safe or --policy trusted, override the regex engine independently with --regex-engine re2 or --regex-engine python, and enable advanced features only when needed with --enable-template-vars (with security warning) or --allow-external-sources. The same security policies apply to both the convert and check commands. These settings are backward compatible—existing scripts can continue with --policy trusted if broader processing is required.

For most users, no action is required—safe defaults protect you automatically. If you need permissive processing with trusted rules, use --policy trusted. If you need specific advanced features, combine options as needed (e.g., --policy trusted --enable-template-vars). This approach reduces your attack surface from regex DoS and code execution while maintaining flexibility for legitimate use cases.

What's Changed

• Fix crash of 'analyze attack' with rulesets without ATT&CK tags by @SkxOverKill in #96
• docs: update backend and pipeline integration instructions by @x0Lazarus in #97
• [high] Report collection errors and broken filters in sigma check by @elhoim in #99
• [high] Exit non-zero and keep converting when a rule fails with --output-dir by @elhoim in #98
• [high] Write finalized, postprocessed queries with --output-dir by @elhoim in #105
• [high] Re-apply #99: report collection errors and broken filters in sigma check (reverted with #105) by @elhoim in #109
• [high] Re-apply #98: exit non-zero and keep converting when a rule fails with --output-dir (reverted with #105) by @elhoim in #110
• [medium] Honour -o for backends returning dict results by @elhoim in #102
• [medium] Add SECURITY.md with a private vulnerability reporting policy by @elhoim in #106
• Migrated to pySigma 2 by @thomaspatzke in #111

New Contributors

• @SkxOverKill made their first contribution in #96
• @x0Lazarus made their first contribution in #97
• @elhoim made their first contribution in #99

Full Changelog: v3.1.0...v4.0.0