diff --git a/sigma/1.0.0/requirements.txt b/sigma/1.0.0/requirements.txt index 755761ce..72a2751a 100644 --- a/sigma/1.0.0/requirements.txt +++ b/sigma/1.0.0/requirements.txt @@ -1,2 +1,3 @@ requests==2.32.4 sigmatools==0.20 +shuffle-sdk==0.0.40 diff --git a/sigma/1.0.0/src/app.py b/sigma/1.0.0/src/app.py index e0b28bf5..28f64efa 100644 --- a/sigma/1.0.0/src/app.py +++ b/sigma/1.0.0/src/app.py @@ -6,7 +6,8 @@ import json import subprocess -from walkoff_app_sdk.app_base import AppBase +# from walkoff_app_sdk.app_base import AppBase +from shuffle_sdk import AppBase # Make file sample with namespace yara: ## curl http://localhost:5001/api/v1/files/create -H "Authorization: Bearer 09627dcb-7e2a-4843-819b-417d268ff840" -d '{"filename": "HelloWorld.yml", "org_id": "11f67b76-6051-4425-b0d6-be23daac6d12", "workflow_id": "global", "namespace": "sigma"}' @@ -15,7 +16,7 @@ # 2. Add a way to choose the rule and the target platform for it # 3. Add the possibility of translating rules back and forth -# 4. Make it so you can start with Mitre Att&ck techniques +# 4. Make it so you can start with Mitre Att&ck techniques # and automatically get the right rules set up with your tools :O class Sigma(AppBase): __version__ = "1.0.0" @@ -52,10 +53,10 @@ def get_searches(self, engine, backend, shuffle_namespace): self.logger.info(f"Dir: {os.listdir(basedir)}") rule = shuffle_namespace - #filename = "file.yaml" + #filename = "file.yaml" #with open(filename, "w+") as tmp: # tmp.write(rule) - + code = "sigmac --target=%s" % engine #if len(backend) > 0: if backend: @@ -63,8 +64,8 @@ def get_searches(self, engine, backend, shuffle_namespace): code += "--list" else: code += " -c %s" % backend - - code += " rules/*" + + code += " rules/*" self.logger.info("Code: ", code) print(code) print() @@ -83,13 +84,13 @@ def get_searches(self, engine, backend, shuffle_namespace): else: print("FAILED to run bash: ", stdout[1]) item = stdout[1] - + try: ret = item.decode("utf-8") return ret except Exception: return item - + return item if __name__ == "__main__":