-
-
Notifications
You must be signed in to change notification settings - Fork 18
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[feature] Type-Aware Field Matcher #31
[feature] Type-Aware Field Matcher #31
Conversation
This seems to allow identical rule output/reloading and better test comparisons.
Co-authored-by: Bradley Kemp <bradleyjkemp@users.noreply.github.com>
I think something odd happened, because I was silly and started working on this in my fork off of the branch that was recently merged. As such, the commit history seems to have the commits from the other merge listed. However, the diff looks just fine, so I don't think it's an issue. If the history gets wonky, we can always squash it on merge anyway. 🤷 Sorry about that. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good to me!
This PR adds the ability to load arbitrarily typed values in a field matcher, however maintains the same evaluation logic (i.e. treating all scalar types as strings and ignoring non-scalar typed values). This includes scalar values like integers, strings and floats as well as complex values which lie outside the scope of the Sigma specification, but could be helpful in extensions during parsing or evaluation of rules using this library.
Given your response to the issue I created, it seems you're open to these changes, so I figured I'd just create the PR and work from here. As such, this closes #30 if merged.