from typing import Dict, List

from sigma.rule import SigmaLogSource

Data_SigmaHQ_file_prefix = {
    "azure_pim": {
        "prefix": "azure_pim_",
        "log": {"category": None, "product": "azure", "service": "pim"},
    },
    "create_remote_thread_win": {
        "prefix": "create_remote_thread_win",
        "log": {
            "category": "create_remote_thread",
            "product": "windows",
            "service": None,
        },
    },
    "create_stream_hash": {
        "prefix": "create_stream_hash_",
        "log": {
            "category": "create_stream_hash",
            "product": "windows",
            "service": None,
        },
    },
    "dns_query_win": {
        "prefix": "dns_query_win_",
        "log": {"category": "dns_query", "product": "windows", "service": None},
    },
    "driver_load_win": {
        "prefix": "driver_load_win_",
        "log": {"category": "driver_load", "product": "windows", "service": None},
    },
    "file_access_win": {
        "prefix": "file_access_win_",
        "log": {"category": "file_access", "product": "windows", "service": None},
    },
    "file_change_win": {
        "prefix": "file_change_win_",
        "log": {"category": "file_change", "product": "windows", "service": None},
    },
    "file_delete_win": {
        "prefix": "file_delete_win_",
        "log": {"category": "file_delete", "product": "windows", "service": None},
    },
    "file_event_lnx": {
        "prefix": "file_event_lnx_",
        "log": {"category": "file_event", "product": "linux", "service": None},
    },
    "file_event_macos": {
        "prefix": "file_event_macos_",
        "log": {"category": "file_event", "product": "macos", "service": None},
    },
    "file_event_win": {
        "prefix": "file_event_win_",
        "log": {"category": "file_event", "product": "windows", "service": None},
    },
    "file_executable_detected": {
        "prefix": "file_executable_detected_win_",
        "log": {
            "category": "file_executable_detected",
            "product": "windows",
            "service": None,
        },
    },
    "file_rename_win": {
        "prefix": "file_rename_win_",
        "log": {"category": "file_rename", "product": "windows", "service": None},
    },
    "image_load": {
        "prefix": "image_load_",
        "log": {"category": "image_load", "product": "windows", "service": None},
    },
    "lnx_auditd": {
        "prefix": "lnx_auditd_",
        "log": {"category": None, "product": "linux", "service": "auditd"},
    },
    "modsec": {
        "prefix": "modsec_",
        "log": {"category": None, "product": "linux", "service": "modsecurity"},
    },
    "net_connection_lnx": {
        "prefix": "net_connection_lnx_",
        "log": {"category": "network_connection", "product": "linux", "service": None},
    },
    "net_connection_macos": {
        "prefix": "net_connection_macos_",
        "log": {"category": "network_connection", "product": "macos", "service": None},
    },
    "net_connection_win": {
        "prefix": "net_connection_win_",
        "log": {
            "category": "network_connection",
            "product": "windows",
            "service": None,
        },
    },
    "net_dns": {
        "prefix": "net_dns_",
        "log": {"category": "dns", "product": "windows", "service": None},
    },
    "net_firewall": {
        "prefix": "net_firewall_",
        "log": {"category": "firewall", "product": None, "service": None},
    },
    "pipe_created": {
        "prefix": "pipe_created_",
        "log": {"category": "pipe_created", "product": "windows", "service": None},
    },
    "posh_pc": {
        "prefix": "posh_pc_",
        "log": {
            "category": None,
            "product": "windows",
            "service": "powershell-classic",
        },
    },
    "posh_pc_1": {
        "prefix": "posh_pc_",
        "log": {
            "category": "ps_classic_provider_start",
            "product": "windows",
            "service": None,
        },
    },
    "posh_pc_2": {
        "prefix": "posh_pc_",
        "log": {"category": "ps_classic_start", "product": "windows", "service": None},
    },
    "posh_pm": {
        "prefix": "posh_pm_",
        "log": {"category": "ps_module", "product": "windows", "service": None},
    },
    "posh_ps": {
        "prefix": "posh_ps_",
        "log": {"category": "ps_script", "product": "windows", "service": None},
    },
    "proc_access_win": {
        "prefix": "proc_access_win_",
        "log": {"category": "process_access", "product": "windows", "service": None},
    },
    "proc_creation_lnx": {
        "prefix": "proc_creation_lnx_",
        "log": {"category": "process_creation", "product": "linux", "service": None},
    },
    "proc_creation_macos": {
        "prefix": "proc_creation_macos_",
        "log": {"category": "process_creation", "product": "macos", "service": None},
    },
    "proc_creation_win": {
        "prefix": "proc_creation_win_",
        "log": {"category": "process_creation", "product": "windows", "service": None},
    },
    "proc_tampering": {
        "prefix": "proc_tampering_",
        "log": {"category": "process_tampering", "product": "windows", "service": None},
    },
    "raw_access_thread": {
        "prefix": "raw_access_thread_",
        "log": {"category": "raw_access_thread", "product": "windows", "service": None},
    },
    "registry_add": {
        "prefix": "registry_add_",
        "log": {"category": "registry_add", "product": "windows", "service": None},
    },
    "registry_delete": {
        "prefix": "registry_delete_",
        "log": {"category": "registry_delete", "product": "windows", "service": None},
    },
    "registry_event": {
        "prefix": "registry_event_",
        "log": {"category": "registry_event", "product": "windows", "service": None},
    },
    "registry_rename": {
        "prefix": "registry_rename_",
        "log": {"category": "registry_rename", "product": "windows", "service": None},
    },
    "registry_set": {
        "prefix": "registry_set_",
        "log": {"category": "registry_set", "product": "windows", "service": None},
    },
    "sysmon": {
        "prefix": "sysmon_",
        "log": {"category": None, "product": "windows", "service": "sysmon"},
    },
    "sysmon_1": {
        "prefix": "sysmon_",
        "log": {"category": "sysmon_error", "product": "windows", "service": None},
    },
    "sysmon_2": {
        "prefix": "sysmon_",
        "log": {"category": "sysmon_status", "product": "windows", "service": None},
    },
    "sysmon_wmi": {
        "prefix": "sysmon_wmi_",
        "log": {"category": "wmi_event", "product": "windows", "service": None},
    },
    "web": {
        "prefix": "web_",
        "log": {"category": "webserver", "product": None, "service": None},
    },
    "win_applocker": {
        "prefix": "win_applocker_",
        "log": {"category": None, "product": "windows", "service": "applocker"},
    },
    "win_bitlocker": {
        "prefix": "win_bitlocker_",
        "log": {"category": None, "product": "windows", "service": "bitlocker"},
    },
    "win_bits_client": {
        "prefix": "win_bits_client_",
        "log": {"category": None, "product": "windows", "service": "bits-client"},
    },
    "win_capi2": {
        "prefix": "win_capi2_",
        "log": {"category": None, "product": "windows", "service": "capi2"},
    },
    "win_certificateservicesclient_lifecycle_system": {
        "prefix": "win_certificateservicesclient_lifecycle_system_",
        "log": {
            "category": None,
            "product": "windows",
            "service": "certificateservicesclient-lifecycle-system",
        },
    },
    "win_codeintegrity": {
        "prefix": "win_codeintegrity_",
        "log": {
            "category": None,
            "product": "windows",
            "service": "codeintegrity-operational",
        },
    },
    "win_defender": {
        "prefix": "win_defender_",
        "log": {"category": None, "product": "windows", "service": "windefend"},
    },
    "win_diagnosis_scripted": {
        "prefix": "win_diagnosis_scripted_",
        "log": {
            "category": None,
            "product": "windows",
            "service": "diagnosis-scripted",
        },
    },
    "win_dns_analytic": {
        "prefix": "win_dns_analytic_",
        "log": {
            "category": None,
            "product": "windows",
            "service": "dns-server-analytic",
        },
    },
    "win_exchange": {
        "prefix": "win_exchange_",
        "log": {
            "category": None,
            "product": "windows",
            "service": "msexchange-management",
        },
    },
    "win_firewall_as": {
        "prefix": "win_firewall_as_",
        "log": {"category": None, "product": "windows", "service": "firewall-as"},
    },
    "win_security": {
        "prefix": "win_security_",
        "log": {"category": None, "product": "windows", "service": "security"},
    },
    "win_system": {
        "prefix": "win_system_",
        "log": {"category": None, "product": "windows", "service": "system"},
    },
    "win_taskscheduler": {
        "prefix": "win_taskscheduler_",
        "log": {"category": None, "product": "windows", "service": "taskscheduler"},
    },
    "win_terminalservices": {
        "prefix": "win_terminalservices_",
        "log": {
            "category": None,
            "product": "windows",
            "service": "terminalservices-localsessionmanager",
        },
    },
    "win_wmi": {
        "prefix": "win_wmi_",
        "log": {"category": None, "product": "windows", "service": "wmi"},
    },
}

Data_SigmaHQ_logsource = [
    {"category": None, "product": None, "service": "apache"},
    {"category": None, "product": None, "service": "netflow"},
    {"category": None, "product": None, "service": "nginx"},
    {"category": None, "product": "aws", "service": "cloudtrail"},
    {"category": None, "product": "azure", "service": "activitylogs"},
    {"category": None, "product": "azure", "service": "auditlogs"},
    {"category": None, "product": "azure", "service": "pim"},
    {"category": None, "product": "azure", "service": "pim"},
    {"category": None, "product": "azure", "service": "riskdetection"},
    {"category": None, "product": "azure", "service": "signinlogs"},
    {"category": None, "product": "bitbucket", "service": "audit"},
    {"category": None, "product": "cisco", "service": "aaa"},
    {"category": None, "product": "cisco", "service": "bgp"},
    {"category": None, "product": "cisco", "service": "duo"},
    {"category": None, "product": "cisco", "service": "ldp"},
    {"category": None, "product": "cisco", "service": "syslog"},
    {"category": None, "product": "fortios", "service": "sslvpnd"},
    {"category": None, "product": "gcp", "service": "gcp.audit"},
    {"category": None, "product": "gcp", "service": "google_workspace.admin"},
    {"category": None, "product": "github", "service": "audit"},
    {"category": None, "product": "huawei", "service": "bgp"},
    {"category": None, "product": "juniper", "service": "bgp"},
    {"category": None, "product": "linux", "service": None},
    {"category": None, "product": "linux", "service": "auditd"},
    {"category": None, "product": "linux", "service": "auth"},
    {"category": None, "product": "linux", "service": "clamav"},
    {"category": None, "product": "linux", "service": "cron"},
    {"category": None, "product": "linux", "service": "guacamole"},
    {"category": None, "product": "linux", "service": "modsecurity"},
    {"category": None, "product": "linux", "service": "modsecurity"},
    {"category": None, "product": "linux", "service": "sshd"},
    {"category": None, "product": "linux", "service": "sudo"},
    {"category": None, "product": "linux", "service": "syslog"},
    {"category": None, "product": "linux", "service": "vsftpd"},
    {"category": None, "product": "m365", "service": "audit"},
    {"category": None, "product": "m365", "service": "exchange"},
    {"category": None, "product": "m365", "service": "threat_detection"},
    {"category": None, "product": "m365", "service": "threat_management"},
    {"category": None, "product": "okta", "service": "okta"},
    {"category": None, "product": "onelogin", "service": "onelogin.events"},
    {"category": None, "product": "qualys", "service": None},
    {"category": None, "product": "windows", "service": None},
    {"category": None, "product": "windows", "service": "application"},
    {"category": None, "product": "windows", "service": "applocker"},
    {"category": None, "product": "windows", "service": "applocker"},
    {"category": None, "product": "windows", "service": "appmodel-runtime"},
    {"category": None, "product": "windows", "service": "appxdeployment-server"},
    {"category": None, "product": "windows", "service": "appxpackaging-om"},
    {"category": None, "product": "windows", "service": "bitlocker"},
    {"category": None, "product": "windows", "service": "bits-client"},
    {"category": None, "product": "windows", "service": "capi2"},
    {"category": None, "product": "windows", "service": "capi2"},
    {
        "category": None,
        "product": "windows",
        "service": "certificateservicesclient-lifecycle-system",
    },
    {"category": None, "product": "windows", "service": "codeintegrity-operational"},
    {"category": None, "product": "windows", "service": "diagnosis-scripted"},
    {"category": None, "product": "windows", "service": "dns-client"},
    {"category": None, "product": "windows", "service": "dns-server"},
    {"category": None, "product": "windows", "service": "dns-server-analytic"},
    {"category": None, "product": "windows", "service": "dns-server-analytic"},
    {"category": None, "product": "windows", "service": "driver-framework"},
    {"category": None, "product": "windows", "service": "firewall-as"},
    {"category": None, "product": "windows", "service": "ldap"},
    {"category": None, "product": "windows", "service": "lsa-server"},
    {"category": None, "product": "windows", "service": "microsoft-servicebus-client"},
    {"category": None, "product": "windows", "service": "msexchange-management"},
    {"category": None, "product": "windows", "service": "msexchange-management"},
    {"category": None, "product": "windows", "service": "ntlm"},
    {"category": None, "product": "windows", "service": "openssh"},
    {"category": None, "product": "windows", "service": "powershell"},
    {"category": None, "product": "windows", "service": "powershell-classic"},
    {"category": None, "product": "windows", "service": "powershell-classic"},
    {"category": None, "product": "windows", "service": "printservice-admin"},
    {"category": None, "product": "windows", "service": "printservice-operational"},
    {"category": None, "product": "windows", "service": "security"},
    {"category": None, "product": "windows", "service": "security"},
    {"category": None, "product": "windows", "service": "security-mitigations"},
    {"category": None, "product": "windows", "service": "shell-core"},
    {"category": None, "product": "windows", "service": "smbclient-connectivity"},
    {"category": None, "product": "windows", "service": "smbclient-mitigations"},
    {"category": None, "product": "windows", "service": "smbclient-security"},
    {"category": None, "product": "windows", "service": "sysmon"},
    {"category": None, "product": "windows", "service": "sysmon"},
    {"category": None, "product": "windows", "service": "system"},
    {"category": None, "product": "windows", "service": "system"},
    {"category": None, "product": "windows", "service": "taskscheduler"},
    {
        "category": None,
        "product": "windows",
        "service": "terminalservices-localsessionmanager",
    },
    {"category": None, "product": "windows", "service": "vhdmp"},
    {"category": None, "product": "windows", "service": "windefend"},
    {"category": None, "product": "windows", "service": "windefend"},
    {"category": None, "product": "windows", "service": "wmi"},
    {"category": None, "product": "windows", "service": "wmi"},
    {"category": None, "product": "zeek", "service": "dce_rpc"},
    {"category": None, "product": "zeek", "service": "dns"},
    {"category": None, "product": "zeek", "service": "http"},
    {"category": None, "product": "zeek", "service": "kerberos"},
    {"category": None, "product": "zeek", "service": "rdp"},
    {"category": None, "product": "zeek", "service": "smb_files"},
    {"category": None, "product": "zeek", "service": "x509"},
    {"category": "antivirus", "product": None, "service": None},
    {"category": "appliance", "product": "paloalto", "service": "globalprotect"},
    {"category": "application", "product": "django", "service": None},
    {"category": "application", "product": "jvm", "service": None},
    {"category": "application", "product": "kubernetes", "service": "audit"},
    {"category": "application", "product": "modsecurity", "service": None},
    {"category": "application", "product": "nodejs", "service": None},
    {"category": "application", "product": "python", "service": None},
    {"category": "application", "product": "opencanary", "service": None},
    {"category": "application", "product": "qualys", "service": None},
    {"category": "application", "product": "rpc_firewall", "service": None},
    {"category": "application", "product": "ruby_on_rails", "service": None},
    {"category": "application", "product": "spring", "service": None},
    {"category": "application", "product": "sql", "service": None},
    {"category": "application", "product": "velocity", "service": None},
    {"category": "create_remote_thread", "product": "windows", "service": None},
    {"category": "create_stream_hash", "product": "windows", "service": None},
    {"category": "database", "product": None, "service": None},
    {"category": "dns", "product": None, "service": None},
    {"category": "dns", "product": "windows", "service": None},
    {"category": "dns_query", "product": "windows", "service": None},
    {"category": "driver_load", "product": "windows", "service": None},
    {"category": "file_access", "product": "windows", "service": None},
    {"category": "file_change", "product": "windows", "service": None},
    {"category": "file_delete", "product": "macos", "service": None},
    {"category": "file_delete", "product": "windows", "service": None},
    {"category": "file_event", "product": "linux", "service": None},
    {"category": "file_event", "product": "macos", "service": None},
    {"category": "file_event", "product": "macos", "service": None},
    {"category": "file_event", "product": "paloalto", "service": "globalprotect"},
    {"category": "file_event", "product": "windows", "service": None},
    {"category": "file_executable_detected", "product": "windows", "service": None},
    {"category": "file_rename", "product": "windows", "service": None},
    {"category": "firewall", "product": None, "service": None},
    {"category": "firewall", "product": None, "service": None},
    {"category": "image_load", "product": "windows", "service": None},
    {"category": "network_connection", "product": "linux", "service": None},
    {"category": "network_connection", "product": "macos", "service": None},
    {"category": "network_connection", "product": "macos", "service": None},
    {"category": "network_connection", "product": "windows", "service": None},
    {"category": "pipe_created", "product": "windows", "service": None},
    {"category": "process_access", "product": "windows", "service": None},
    {"category": "process_creation", "product": "linux", "service": None},
    {"category": "process_creation", "product": "macos", "service": None},
    {"category": "process_creation", "product": "macos", "service": None},
    {"category": "process_creation", "product": "windows", "service": None},
    {"category": "process_tampering", "product": "windows", "service": None},
    {"category": "process_termination", "product": "macos", "service": None},
    {"category": "proxy", "product": None, "service": None},
    {"category": "ps_classic_provider_start", "product": "windows", "service": None},
    {"category": "ps_classic_provider_start", "product": "windows", "service": None},
    {"category": "ps_classic_start", "product": "windows", "service": None},
    {"category": "ps_classic_start", "product": "windows", "service": None},
    {"category": "ps_module", "product": "windows", "service": None},
    {"category": "ps_script", "product": "windows", "service": None},
    {"category": "raw_access_read", "product": "macos", "service": None},
    {"category": "raw_access_thread", "product": "windows", "service": None},
    {"category": "registry_add", "product": "windows", "service": None},
    {"category": "registry_delete", "product": "windows", "service": None},
    {"category": "registry_event", "product": "windows", "service": None},
    {"category": "registry_rename", "product": "windows", "service": None},
    {"category": "registry_set", "product": "windows", "service": None},
    {"category": "sysmon_error", "product": "windows", "service": None},
    {"category": "sysmon_error", "product": "windows", "service": None},
    {"category": "sysmon_status", "product": "macos", "service": None},
    {"category": "sysmon_status", "product": "windows", "service": None},
    {"category": "webserver", "product": None, "service": None},
    {"category": "webserver", "product": None, "service": None},
    {"category": "wmi_event", "product": "windows", "service": None},
]

Data_SigmaHQ_product_prefix = {
    "aws": "aws_",
    "azure": "azure_",
    "gcp": "gcp_",
    "github": "github_",
    "linux": "lnx_",
    "m365": "microsoft365_",
    "macos": "macos_",
    "okta": "okta_",
    "onelogin": "onelogin_",
    "windows": "win_",
}

Data_SigmaHQ_field_cast = {
    "lnx_auditd": {
        "log": {"category": None, "product": "linux", "service": "auditd"},
        "field": [
            "a0",
            "a1",
            "a2",
            "a3",
            "a4",
            "a5",
            "a6",
            "a7",
            "a8",
            "a9",
            "acct",
            "acl",
            "action",
            "added",
            "addr",
            "apparmor",
            "arch",
            "argc",
            "audit_backlog_limit",
            "audit_backlog_wait_time",
            "audit_enabled",
            "audit_failure",
            "auid",
            "banners",
            "bool",
            "bus",
            "cap_fe,cap_fi",
            "cap_fp",
            "cap_fver",
            "cap_pa",
            "cap_pe",
            "cap_pi",
            "cap_pp",
            "capability",
            "category",
            "cgroup",
            "changed",
            "cipher",
            "class",
            "cmd",
            "code",
            "comm",
            "compat",
            "cwd",
            "daddr",
            "data",
            "default-context",
            "dev",
            "dev",
            "device",
            "dir",
            "direction",
            "dmac",
            "dport",
            "egid",
            "enforcing",
            "entries",
            "errno",
            "euid",
            "exe",
            "exit",
            "fam",
            "family",
            "fd",
            "fe",
            "feature",
            "fi",
            "file",
            "flags",
            "format",
            "fp",
            "fsgid",
            "fsuid",
            "fver",
            "gid",
            "grantors",
            "grp",
            "hook",
            "hostname",
            "icmp_type",
            "id",
            "igid",
            "img-ctx",
            "inif",
            "ino",
            "inode",
            "inode_gid",
            "inode_uid",
            "invalid_context",
            "ioctlcmd",
            "ip",
            "ipid",
            "ipx-net",
            "item",
            "items",
            "iuid",
            "kernel",
            "key",
            "kind",
            "ksize",
            "laddr",
            "len",
            "list",
            "lport",
            "mac",
            "macproto",
            "maj",
            "major",
            "minor",
            "mode",
            "model",
            "msg",
            "name",
            "nametype",
            "nargs",
            "net",
            "new",
            "new_gid",
            "new_lock",
            "new_pe",
            "new_pi",
            "new_pp",
            "new-chardev",
            "new-disk",
            "new-enabled",
            "new-fs",
            "new-level",
            "new-log_passwd",
            "new-mem",
            "new-net",
            "new-range",
            "new-rng",
            "new-role",
            "new-seuser",
            "new-vcpu",
            "nlnk-fam",
            "nlnk-grp",
            "nlnk-pid",
            "oauid",
            "obj",
            "obj_gid",
            "obj_uid",
            "ocomm",
            "oflag",
            "ogid",
            "old",
            "old_enforcing",
            "old_lock",
            "old_pa",
            "old_pe",
            "old_pi",
            "old_pp",
            "old_prom",
            "old_val",
            "old-auid",
            "old-chardev",
            "old-disk",
            "old-enabled",
            "old-fs",
            "old-level",
            "old-log_passwd",
            "old-mem",
            "old-net",
            "old-range",
            "old-rng",
            "old-role",
            "old-ses",
            "old-seuser",
            "old-vcpu",
            "op",
            "opid",
            "oses",
            "ouid",
            "outif",
            "pa",
            "parent",
            "path",
            "pe",
            "per",
            "perm",
            "perm_mask",
            "permissive",
            "pfs",
            "pi",
            "pid",
            "pp",
            "ppid",
            "printer",
            "proctitle",
            "prom",
            "proto",
            "qbytes",
            "range",
            "rdev",
            "reason",
            "removed",
            "res",
            "resrc",
            "result",
            "role",
            "rport",
            "saddr",
            "sauid",
            "scontext",
            "selected-context",
            "seperm",
            "seperms",
            "seqno",
            "seresult",
            "ses",
            "seuser",
            "sgid",
            "sig",
            "sigev_signo",
            "smac",
            "spid",
            "sport",
            "state",
            "subj",
            "success",
            "suid",
            "syscall",
            "table",
            "tclass",
            "tcontext",
            "terminal",
            "tty",
            "type",
            "uid",
            "unit",
            "uri",
            "user",
            "uuid",
            "val",
            "val",
            "ver",
            "virt",
            "vm",
            "vm-ctx",
            "vm-pid",
            "watch",
        ],
    },
    "lnx_file_delete": {
        "log": {"category": "file_delete", "product": "linux", "service": None},
        "field": [
            "ProcessGuid",
            "ProcessId",
            "User",
            "Image",
            "TargetFilename",
            "Hashes",
            "IsExecutable",
            "Archived",
        ],
    },
    "lnx_file_event": {
        "log": {"category": "file_event", "product": "linux", "service": None},
        "field": [
            "ProcessGuid",
            "ProcessId",
            "Image",
            "TargetFilename",
            "CreationUtcTime",
            "User",
        ],
    },
    "lnx_network_connection": {
        "log": {"category": "network_connection", "product": "linux", "service": None},
        "field": [
            "ProcessGuid",
            "ProcessId",
            "Image",
            "User",
            "Protocol",
            "Initiated",
            "SourceIsIpv6",
            "SourceIp",
            "SourceHostname",
            "SourcePort",
            "SourcePortName",
            "DestinationIsIpv6",
            "DestinationIp",
            "DestinationHostname",
            "DestinationPort",
            "DestinationPortName",
        ],
    },
    "lnx_process_creation": {
        "log": {"category": "process_creation", "product": "linux", "service": None},
        "field": [
            "ProcessGuid",
            "ProcessId",
            "Image",
            "FileVersion",
            "Description",
            "Product",
            "Company",
            "OriginalFileName",
            "CommandLine",
            "CurrentDirectory",
            "User",
            "LogonGuid",
            "LogonId",
            "TerminalSessionId",
            "IntegrityLevel",
            "Hashes",
            "ParentProcessGuid",
            "ParentProcessId",
            "ParentImage",
            "ParentCommandLine",
            "ParentUser",
        ],
    },
    "lnx_process_termination": {
        "log": {"category": "process_termination", "product": "linux", "service": None},
        "field": ["ProcessGuid", "ProcessId", "Image", "User"],
    },
    "lnx_raw_access_read": {
        "log": {"category": "raw_access_read", "product": "linux", "service": None},
        "field": ["ProcessGuid", "ProcessId", "Image", "Device", "User"],
    },
    "lnx_sysmon_status": {
        "log": {"category": "sysmon_status", "product": "linux", "service": None},
        "field": ["Configuration", "ConfigurationFileHash"],
    },
    "macos_file_delete": {
        "log": {"category": "file_delete", "product": "macos", "service": None},
        "field": [
            "ProcessGuid",
            "ProcessId",
            "User",
            "Image",
            "TargetFilename",
            "Hashes",
            "IsExecutable",
            "Archived",
        ],
    },
    "macos_file_event": {
        "log": {"category": "file_event", "product": "macos", "service": None},
        "field": [
            "ProcessGuid",
            "ProcessId",
            "Image",
            "TargetFilename",
            "CreationUtcTime",
            "User",
        ],
    },
    "macos_network_connection": {
        "log": {"category": "network_connection", "product": "macos", "service": None},
        "field": [
            "ProcessGuid",
            "ProcessId",
            "Image",
            "User",
            "Protocol",
            "Initiated",
            "SourceIsIpv6",
            "SourceIp",
            "SourceHostname",
            "SourcePort",
            "SourcePortName",
            "DestinationIsIpv6",
            "DestinationIp",
            "DestinationHostname",
            "DestinationPort",
            "DestinationPortName",
        ],
    },
    "macos_process_creation": {
        "log": {"category": "process_creation", "product": "macos", "service": None},
        "field": [
            "ProcessGuid",
            "ProcessId",
            "Image",
            "FileVersion",
            "Description",
            "Product",
            "Company",
            "OriginalFileName",
            "CommandLine",
            "CurrentDirectory",
            "User",
            "LogonGuid",
            "LogonId",
            "TerminalSessionId",
            "IntegrityLevel",
            "Hashes",
            "ParentProcessGuid",
            "ParentProcessId",
            "ParentImage",
            "ParentCommandLine",
            "ParentUser",
        ],
    },
    "macos_process_termination": {
        "log": {"category": "process_termination", "product": "macos", "service": None},
        "field": ["ProcessGuid", "ProcessId", "Image", "User"],
    },
    "macos_raw_access_read": {
        "log": {"category": "raw_access_read", "product": "macos", "service": None},
        "field": ["ProcessGuid", "ProcessId", "Image", "Device", "User"],
    },
    "macos_sysmon_status": {
        "log": {"category": "sysmon_status", "product": "macos", "service": None},
        "field": ["Configuration", "ConfigurationFileHash"],
    },
    "proxy": {
        "log": {"category": "proxy", "product": None, "service": None},
        "field": [
            "c-uri",
            "c-uri-extension",
            "c-uri-query",
            "c-uri-stem",
            "c-useragent",
            "cs-bytes",
            "cs-cookie",
            "cs-host",
            "cs-method",
            "r-dns",
            "cs-referrer",
            "cs-version",
            "sc-bytes",
            "sc-status",
            "src_ip",
            "dst_ip",
            "cs-uri",
        ],
    },
    "webserver": {
        "log": {"category": "webserver", "product": None, "service": None},
        "field": [
            "date",
            "time",
            "c-ip",
            "cs-username",
            "s-sitename",
            "s-computername",
            "s-ip",
            "cs-method",
            "cs-uri-stem",
            "cs-uri-query",
            "s-port",
            "cs-method",
            "sc-status",
            "sc-win32-status",
            "sc-bytes",
            "cs-bytes",
            "time-taken",
            "cs-version",
            "cs-host",
            "cs-user-agent",
            "cs-referer",
            "cs-cookie",
        ],
    },
    "win_appmodel-runtime": {
        "log": {"category": None, "product": "windows", "service": "appmodel-runtime"},
        "field": [
            "ProcessID",
            "PackageName",
            "ImageName",
            "ApplicationName",
            "Message",
        ],
    },
    "win_appxdeployment-server": {
        "log": {
            "category": None,
            "product": "windows",
            "service": "appxdeployment-server",
        },
        "field": [
            "Path",
            "AppId",
            "FilePath",
            "ErrorCode",
            "DeploymentOperation",
            "PackageFullName",
            "PackageSourceUri",
            "PackageDisplayName",
            "CallingProcess",
        ],
    },
    "win_appxpackaging-om": {
        "log": {"category": None, "product": "windows", "service": "appxpackaging-om"},
        "field": ["subjectName"],
    },
    "win_bitlocker": {
        "log": {"category": None, "product": "windows", "service": "bitlocker"},
        "field": ["VolumeName", "VolumeMountPoint", "ProtectorGUID", "ProtectorType"],
    },
    "win_bits-client": {
        "log": {"category": None, "product": "windows", "service": "bits-client"},
        "field": ["RemoteName", "LocalName", "processPath", "processId"],
    },
    "win_clipboard_capture": {
        "log": {"category": "clipboard_capture", "product": "windows", "service": None},
        "field": [
            "Archived",
            "ClientInfo",
            "Hashes",
            "Image",
            "ProcessGuid",
            "ProcessId",
            "Session",
            "User",
        ],
    },
    "win_codeintegrity-operational": {
        "log": {
            "category": None,
            "product": "windows",
            "service": "codeintegrity-operational",
        },
        "field": [
            "FileNameLength",
            "FileNameBuffer",
            "ProcessNameLength",
            "ProcessNameBuffer",
            "RequestedPolicy",
            "ValidatedPolicy",
            "Status",
        ],
    },
    "win_create_remote_thread": {
        "log": {
            "category": "create_remote_thread",
            "product": "windows",
            "service": None,
        },
        "field": [
            "NewThreadId",
            "SourceImage",
            "SourceProcessGuid",
            "SourceProcessId",
            "SourceUser",
            "StartAddress",
            "StartFunction",
            "StartModule",
            "TargetImage",
            "TargetProcessGuid",
            "TargetProcessId",
            "TargetUser",
            "SourceParentImage",
            "User",
            "SourceCommandLine",
            "SourceParentProcessId",
            "SourceParentImage",
            "SourceParentCommandLine",
            "TargetCommandLine",
            "TargetParentProcessId",
            "TargetParentImage",
            "TargetParentCommandLine",
            "IsInitialThread",
            "RemoteCreation",
        ],
    },
    "win_create_stream_hash": {
        "log": {
            "category": "create_stream_hash",
            "product": "windows",
            "service": None,
        },
        "field": [
            "Contents",
            "CreationUtcTime",
            "Hash",
            "Image",
            "ProcessGuid",
            "ProcessId",
            "TargetFilename",
            "User",
        ],
    },
    "win_diagnosis-scripted": {
        "log": {
            "category": None,
            "product": "windows",
            "service": "diagnosis-scripted",
        },
        "field": ["PackagePath", "PackageId"],
    },
    "win_dns-client": {
        "log": {"category": None, "product": "windows", "service": "dns-client"},
        "field": [
            "QueryName",
            "QueryType",
            "QueryOptions",
            "QueryStatus",
            "QueryResults",
            "NetworkIndex",
            "InterfaceIndex",
            "Status",
            "ClientPID",
            "QueryBlob",
            "DnsServerIpAddress",
            "ResponseStatus",
            "SendBlob",
            "SendBlobContext",
            "AddressLength",
            "Address",
        ],
    },
    "win_dns_query": {
        "log": {"category": "dns_query", "product": "windows", "service": None},
        "field": [
            "Image",
            "ProcessGuid",
            "ProcessId",
            "QueryName",
            "QueryResults",
            "QueryStatus",
            "User",
        ],
    },
    "win_driver_load": {
        "log": {"category": "driver_load", "product": "windows", "service": None},
        "field": ["Hashes", "ImageLoaded", "Signature", "SignatureStatus", "Signed"],
    },
    "win_file_access": {
        "log": {"category": "file_access", "product": "windows", "service": None},
        "field": [
            "Irp",
            "FileObject",
            "IssuingThreadId",
            "CreateOptions",
            "CreateAttributes",
            "ShareAccess",
            "FileName",
            "Image",
            "CommandLine",
            "ParentImage",
            "ParentCommandLine",
            "User",
            "TargetFilename",
        ],
    },
    "win_file_block": {
        "log": {"category": "file_block", "product": "windows", "service": None},
        "field": [
            "Hashes",
            "Image",
            "ProcessGuid",
            "ProcessId",
            "TargetFilename",
            "User",
        ],
    },
    "win_file_change": {
        "log": {"category": "file_change", "product": "windows", "service": None},
        "field": [
            "CreationUtcTime",
            "Image",
            "PreviousCreationUtcTime",
            "ProcessGuid",
            "ProcessId",
            "TargetFilename",
            "User",
        ],
    },
    "win_file_delete": {
        "log": {"category": "file_delete", "product": "windows", "service": None},
        "field": [
            "Archived",
            "Hashes",
            "Image",
            "IsExecutable",
            "ProcessGuid",
            "ProcessId",
            "TargetFilename",
            "User",
        ],
    },
    "win_file_event": {
        "log": {"category": "file_event", "product": "windows", "service": None},
        "field": [
            "ProcessGuid",
            "ProcessId",
            "Image",
            "TargetFilename",
            "CreationUtcTime",
            "User",
            "CommandLine",
            "ParentImage",
            "ParentCommandLine",
            "MagicHeader",
        ],
    },
    "win_file_rename": {
        "log": {"category": "file_rename", "product": "windows", "service": None},
        "field": [
            "Irp",
            "FileObject",
            "FileKey",
            "ExtraInformation",
            "IssuingThreadId",
            "InfoClass",
            "FilePath",
            "Image",
            "CommandLine",
            "ParentImage",
            "ParentCommandLine",
            "User",
            "OriginalFileName",
            "SourceFilename",
            "TargetFilename",
            "MagicHeader",
        ],
    },
    "win_firewall-as": {
        "log": {"category": None, "product": "windows", "service": "firewall-as"},
        "field": ["Action", "ApplicationPath", "ModifyingApplication"],
    },
    "win_iis": {
        "log": {"category": None, "product": "windows", "service": "iis"},
        "field": [
            "date",
            "time",
            "c-ip",
            "cs-username",
            "s-sitename",
            "s-computername",
            "s-ip",
            "cs-method",
            "cs-uri-stem",
            "cs-uri-query",
            "s-port",
            "cs-method",
            "sc-status",
            "sc-win32-status",
            "sc-bytes",
            "cs-bytes",
            "time-taken",
            "cs-version",
            "cs-host",
            "cs-user-agent",
            "cs-referer",
            "cs-cookie",
        ],
    },
    "win_image_load": {
        "log": {"category": "image_load", "product": "windows", "service": None},
        "field": [
            "Company",
            "Description",
            "FileVersion",
            "Hashes",
            "Image",
            "ImageLoaded",
            "OriginalFileName",
            "ProcessGuid",
            "ProcessId",
            "Product",
            "Signature",
            "SignatureStatus",
            "Signed",
            "User",
            "CommandLine",
        ],
    },
    "win_ldap": {
        "log": {"category": None, "product": "windows", "service": "ldap"},
        "field": [
            "ScopeOfSearch",
            "SearchFilter",
            "DistinguishedName",
            "AttributeList",
            "ProcessId",
        ],
    },
    "win_lsa-server": {
        "log": {"category": None, "product": "windows", "service": "lsa-server"},
        "field": [
            "TargetUserSid",
            "TargetUserName",
            "TargetDomainName",
            "TargetLogonId",
            "TargetLogonGuid",
            "EventOrginal",
            "EventCountTotal",
            "SidList",
        ],
    },
    "win_network_connection": {
        "log": {
            "category": "network_connection",
            "product": "windows",
            "service": None,
        },
        "field": [
            "DestinationHostname",
            "DestinationIp",
            "DestinationIsIpv6",
            "DestinationPort",
            "DestinationPortName",
            "Image",
            "Initiated",
            "ProcessGuid",
            "ProcessId",
            "Protocol",
            "SourceHostname",
            "SourceIp",
            "SourceIsIpv6",
            "SourcePort",
            "SourcePortName",
            "User",
            "ParentImage",
            "CommandLine",
            "ParentImage",
        ],
    },
    "win_ntlm": {
        "log": {"category": None, "product": "windows", "service": "ntlm"},
        "field": [
            "CallerPID",
            "ClientDomainName",
            "ClientLUID",
            "ClientUserName",
            "DomainName",
            "MechanismOID",
            "ProcessName",
            "SChannelName",
            "SChannelType",
            "TargetName",
            "UserName",
            "WorkstationName",
        ],
    },
    "win_openssh": {
        "log": {"category": None, "product": "windows", "service": "openssh"},
        "field": ["process", "payload"],
    },
    "win_pipe_created": {
        "log": {"category": "pipe_created", "product": "windows", "service": None},
        "field": ["EventType", "Image", "PipeName", "ProcessGuid", "ProcessId", "User"],
    },
    "win_proc_creation": {
        "log": {"category": "process_creation", "product": "windows", "service": None},
        "field": [
            "CommandLine",
            "Company",
            "CurrentDirectory",
            "Description",
            "FileVersion",
            "Hashes",
            "Image",
            "IntegrityLevel",
            "LogonGuid",
            "LogonId",
            "OriginalFileName",
            "ParentCommandLine",
            "ParentImage",
            "ParentProcessGuid",
            "ParentProcessId",
            "ParentUser",
            "ProcessGuid",
            "ProcessId",
            "Product",
            "TerminalSessionId",
            "User",
            "GrandParentImage",
            "GrandparentCommandLine",
        ],
    },
    "win_process_access": {
        "log": {"category": "process_access", "product": "windows", "service": None},
        "field": [
            "CallTrace",
            "GrantedAccess",
            "SourceImage",
            "SourceProcessGUID",
            "SourceProcessId",
            "SourceThreadId",
            "SourceUser",
            "TargetImage",
            "TargetProcessGUID",
            "TargetProcessId",
            "TargetUser",
            "SourceCommandLine",
            "CallTraceExtended",
        ],
    },
    "win_process_tampering": {
        "log": {"category": "process_tampering", "product": "windows", "service": None},
        "field": ["Image", "ProcessGuid", "ProcessId", "Type", "User"],
    },
    "win_process_termination": {
        "log": {
            "category": "process_termination",
            "product": "windows",
            "service": None,
        },
        "field": ["Image", "ProcessGuid", "ProcessId", "User"],
    },
    "win_ps_module": {
        "log": {"category": "ps_module", "product": "windows", "service": None},
        "field": ["ContextInfo", "UserData", "Payload"],
    },
    "win_ps_script": {
        "log": {"category": "ps_script", "product": "windows", "service": None},
        "field": [
            "MessageNumber",
            "MessageTotal",
            "ScriptBlockText",
            "ScriptBlockId",
            "Path",
        ],
    },
    "win_raw_access_read": {
        "log": {"category": "raw_access_read", "product": "windows", "service": None},
        "field": [
            "CreationUtcTime",
            "Image",
            "ProcessGuid",
            "ProcessId",
            "TargetFilename",
            "User",
        ],
    },
    "win_raw_access_thread": {
        "log": {"category": "raw_access_thread", "product": "windows", "service": None},
        "field": ["Device", "Image", "ProcessGuid", "ProcessId", "User"],
    },
    "win_registry_add": {
        "log": {"category": "registry_add", "product": "windows", "service": None},
        "field": [
            "EventType",
            "ProcessGuid",
            "ProcessId",
            "Image",
            "TargetObject",
            "User",
        ],
    },
    "win_registry_delete": {
        "log": {"category": "registry_delete", "product": "windows", "service": None},
        "field": [
            "Details",
            "EventType",
            "Image",
            "ProcessGuid",
            "ProcessId",
            "TargetObject",
            "CommandLine",
            "ParentImage",
            "ParentCommandLine",
        ],
    },
    "win_registry_event": {
        "log": {"category": "registry_event", "product": "windows", "service": None},
        "field": [
            "Details",
            "EventType",
            "Image",
            "NewName",
            "ProcessGuid",
            "ProcessId",
            "TargetObject",
            "User",
        ],
    },
    "win_registry_rename": {
        "log": {"category": "registry_rename", "product": "windows", "service": None},
        "field": [
            "EventType",
            "Image",
            "NewName",
            "ProcessGuid",
            "ProcessId",
            "TargetObject",
            "User",
        ],
    },
    "win_registry_set": {
        "log": {"category": "registry_set", "product": "windows", "service": None},
        "field": [
            "Details",
            "EventType",
            "Image",
            "ProcessGuid",
            "ProcessId",
            "TargetObject",
            "User",
        ],
    },
    "win_security-mitigations": {
        "log": {
            "category": None,
            "product": "windows",
            "service": "security-mitigations",
        },
        "field": [
            "ProcessPathLength",
            "ProcessPath",
            "ProcessCommandLineLength",
            "ProcessCommandLine",
            "ProcessId",
            "ProcessCreateTime",
            "ProcessStartKey",
            "ProcessSignatureLevel",
            "ProcessSectionSignatureLevel",
            "ProcessProtection",
            "TargetThreadId",
            "TargetThreadCreateTime",
            "RequiredSignatureLevel",
            "SignatureLevel",
            "ImageNameLength",
            "ImageName",
        ],
    },
    "win_shell-core": {
        "log": {"category": None, "product": "windows", "service": "shell-core"},
        "field": ["Name", "AppID", "Flags"],
    },
    "win_smbclient-security": {
        "log": {
            "category": None,
            "product": "windows",
            "service": "smbclient-security",
        },
        "field": [
            "Reason",
            "Status",
            "ShareNameLength",
            "ShareName",
            "ObjectNameLength",
            "ObjectName",
            "UserNameLength",
            "UserName",
            "ServerNameLength",
            "ServerName",
        ],
    },
    "win_sysmon_status": {
        "log": {"category": "sysmon_status", "product": "windows", "service": None},
        "field": [
            "Configuration",
            "ConfigurationFileHash",
            "SchemaVersion",
            "State",
            "Version",
        ],
    },
    "win_taskscheduler": {
        "log": {"category": None, "product": "windows", "service": "taskscheduler"},
        "field": [
            "TaskName",
            "UserContext",
            "Path",
            "ProcessID",
            "Priority",
            "UserName",
        ],
    },
    "win_terminalservices-localsessionmanager": {
        "log": {"category": None, "product": "windows", "service": None},
        "field": ["User", "SessionID", "Address"],
    },
    "win_wmi_event": {
        "log": {"category": "wmi_event", "product": "windows", "service": None},
        "field": [
            "Consumer",
            "Destination",
            "EventNamespace",
            "EventType",
            "Filter",
            "Name",
            "Operation",
            "Query",
            "Type",
            "User",
        ],
    },
}


class ConfigHq:
    title_lengh = 110
    allowed_lowercase_words = [
        "the",
        "for",
        "in",
        "with",
        "via",
        "on",
        "to",
        "without",
        "of",
        "through",
        "from",
        "by",
        "as",
        "a",
        "or",
        "at",
        "and",
        "an",
        "over",
        "new",
    ]
    sigmahq_fp_banned_word = ["none", "pentest", "penetration"]
    sigmahq_fp_typo_word = ["unkown", "ligitimate", "legitim ", "legitimeate"]
    sigmahq_link_in_description = ["http://", "https://", "internal research"]
    sigmahq_logsource_cast: Dict[SigmaLogSource, List[str]] = {}
    sigmahq_logsource_unicast: Dict[SigmaLogSource, List[str]] = {}
    sigmahq_logsource_list: Dict[SigmaLogSource, str] = {}
    sigmahq_logsource_prefix: Dict[SigmaLogSource, str] = {}
    sigmahq_product_prefix: Dict[str, str] = {}

    def __init__(self) -> None:
        # Field name cast by logsource
        for v in Data_SigmaHQ_field_cast.values():
            field = v["field"]
            self.sigmahq_logsource_cast[SigmaLogSource.from_dict(v["log"])] = field

            if "Hashes" in field or "Hash" in field:
                field.extend(["Imphash", "md5", "sha1", "sha256"])

            if v["log"]["product"] == "windows":
                field.extend(
                    [
                        "EventID",
                        "Provider_Name",
                        "Channel",
                        "Computer",
                        "Security_UserID",
                    ]
                )

            self.sigmahq_logsource_unicast[SigmaLogSource.from_dict(v["log"])] = [
                x.lower() for x in field
            ]

        # Valid logsource list
        for v in Data_SigmaHQ_logsource:
            self.sigmahq_logsource_list[SigmaLogSource.from_dict(v)] = ""

        # SigmaHQ filename
        for v in Data_SigmaHQ_file_prefix.values():
            self.sigmahq_logsource_prefix[SigmaLogSource.from_dict(v["log"])] = v[
                "prefix"
            ]

        # SigmaHQ product only filename
        for k, v in Data_SigmaHQ_product_prefix.items():
            self.sigmahq_product_prefix[k] = v
