# -*- coding: utf-8 -*-
from setuptools import setup

packages = \
['sigma',
 'sigma.backends.test',
 'sigma.conversion',
 'sigma.data',
 'sigma.pipelines',
 'sigma.pipelines.test',
 'sigma.processing',
 'sigma.validators',
 'sigma.validators.core']

package_data = \
{'': ['*']}

install_requires = \
['packaging>=22.0,<23.0',
 'pyparsing>=3.0.7,<4.0.0',
 'pyyaml>=6.0,<7.0',
 'requests>=2.28.1,<3.0.0']

setup_kwargs = {
    'name': 'pysigma',
    'version': '0.9.4',
    'description': 'Sigma rule processing and conversion tools',
    'long_description': '# pySigma\n\n![Tests](https://github.com/SigmaHQ/pySigma/actions/workflows/test.yml/badge.svg)\n![Coverage Badge](https://img.shields.io/endpoint?url=https://gist.githubusercontent.com/thomaspatzke/11b31b4f709b6dc54a30d5203e8fe0ee/raw/SigmaHQ-pySigma-coverage.json)\n![Status](https://img.shields.io/badge/Status-pre--release-orange)\n\n`pySigma` is a python library that parses and converts Sigma rules into queries. It is a replacement\nfor the legacy Sigma toolchain (sigmac) with a much cleaner design and is almost fully tested.\nBackends for support of conversion into query languages and processing pipelines for transforming\nrule for log data models are separated into dedicated projects to keep pySigma itself slim and\nvendor-agnostic. See the *Related Projects* section below to get an overview.\n\n## Getting Started\n\nTo start using `pySigma`, install it using your python package manager of choice. Examples:\n\n```\npip install pysigma\npipenv install pysigma\npoetry add pysigma\n```\n\nDocumentation with some usage examples can be found [here](https://sigmahq-pysigma.readthedocs.io/).\n\n## Create Your Own Backend for pySigma\n\nThe creation of a backend has become much easier with pySigma. We recommend using the "Cookie Cutter Template" and reviewing the existing backends listed in the "Related Projects" section of this README.\n\n[pySigma Cookie Cutter Template](https://github.com/SigmaHQ/cookiecutter-pySigma-backend)\n\n## Features\n\n`pySigma` brings a number of additional features compared to `sigmac`, as well as some changes.\n\n### Modifier comparison between pySigma and sigmac\n\n|Modifier|Use|sigmac legacy|\n|--------|---|:-------------:|\n|contains|the value is matched anywhere in the field (strings and regular expressions)|X|\n|startswith|The value is expected at the beginning of the field\'s content (strings and regular expressions)|X|\n|endswith|The value is expected at the end of the field\'s content (strings and regular expressions)|X|\n|base64|The value is encoded with Base64|X|\n|base64offset|If a value might appear somewhere in a base64-encoded value the representation might change depending on the position in the overall value|X|\n|wide|transforms value to UTF16-LE encoding|X|\n|re|value is handled as regular expression by backends|X|\n|cidr|value is handled as an IPv4 CIDR by backends (IPv6 is not supported, yet)||\n|all|This modifier changes OR logic to AND|X|\n|lt|Field is less than the value||\n|lte|Field is less or egal than the value||\n|gt|Field is Greater than the value||\n|gte|Field is Greater or egal than the value||\n|expand|Modifier for expansion of placeholders in values. It replaces placeholder strings (%something%)||\n\n### Backends comparison between pySigma and sigmac\nOn 2022/04/10\n|sigmac Backends|Observation|pySigma|\n|---------------|-----------|:-----:|\n|ala |Azure Log Analytics Queries||\n|ala-rule|Azure Log Analytics Rule||\n|arcsight|ArcSight saved search||\n|arcsight-esm|ArcSight ESM saved search||\n|athena|SQL query||\n|carbonblack|Converts Sigma rule into CarbonBlack query string|\n|chronicle|Google Chronicle YARA-L|\n|crowdstrike|CrowdStrike Search Processing Language (SPL)|[pySigma-pipeline-crowdstrike](https://github.com/SigmaHQ/pySigma-pipeline-crowdstrike)|\n|csharp|CSharp Regex in LINQ query|\n|datadog-logs|Datadog log search query|\n|devo|Devo query|\n|ee-outliers|ee-outliers|\n|elastalert|ElastAlert QS query|\n|elastalert-dsl|ElastAlert DSL query|\n|es-dsl|Elasticsearch DSL query|[pySigma-backend-elasticsearch](https://github.com/SigmaHQ/pySigma-backend-elasticsearch)|\n|es-eql|Elasticsearch EQL query|\n|es-qs|Elasticsearch query string. Only searches, no aggregations|[pySigma-backend-elasticsearch](https://github.com/SigmaHQ/pySigma-backend-elasticsearch)|\n| es-qs-lr|Lucene query string for LogRhythm. Only searches, no aggregations|\n|es-rule|Elastic SIEM lucene query|\n|es-rule-eql|Elastic SIEM EQL query|\n|fieldlist|List all fieldnames from given Sigma rules for creation of a field mapping configuration|\n|fireeye-helix|FireEye Helix Query Language|\n|fortisiem|Base class for Fortisem backends that generate one text-based expression from a Sigma rule|\n|graylog|Graylog query string. Only searches, no aggregations|\n|grep|Generates Perl compatible regular expressions and puts \'grep -P\' around it|\n|hawk|HAWK search|\n|humio|Humio query|\n|kibana|Kibana JSON Configuration files (searches only)|\n|kibana-ndjson|Kibana JSON Configuration files (searches only)|[pySigma-backend-elasticsearch](https://github.com/SigmaHQ/pySigma-backend-elasticsearch)|\n|lacework|Lacework Policy Platform|\n|limacharlie|LimaCharlie D&R rules|\n|logiq|LOGIQ event rule api payload|\n|logpoint|LogPoint query|\n|mdatp|Microsoft Defender ATP Hunting Queries|\n|netwitness|NetWitness saved search|\n|netwitness-epl|RSA NetWitness EPL|\n|es-qs (proxied)|OpenSearch search query string. Only searches, no aggregations|[pySigma-backend-opensearch](https://github.com/SigmaHQ/pySigma-backend-opensearch) (proxied by [pySigma-backend-elasticsearch](https://github.com/SigmaHQ/pySigma-backend-elasticsearch)) |\n|es-dsl (proxied)|OpenSearch DSL query|[pySigma-backend-opensearch](https://github.com/SigmaHQ/pySigma-backend-opensearch) (proxied by [pySigma-backend-elasticsearch](https://github.com/SigmaHQ/pySigma-backend-elasticsearch)) |\n|opensearch-monitor|OpenSearch monitors and ElasticRule are in Elastic Common Schema|[pySigma-backend-opensearch](https://github.com/SigmaHQ/pySigma-backend-opensearch)|\n|powershell|PowerShell event log cmdlets|\n|qradar|Qradar saved search|\n|qualys|Qualys saved search|\n|sentinel-rule|Azure Sentinel scheduled alert rule ARM template|\n|splunk|Splunk Search Processing Language (SPL)|[pySigma-backend-splunk](https://github.com/SigmaHQ/pySigma-backend-splunk)|\n|splunkdm|Splunk syntax leveraging Datamodel acceleration|\n|splunkxml|XML used for Splunk Dashboard Panels|\n|sql|SQL query|\n|sqlite|SQL query for SQLite|\n|stix|STIX pattern|\n|sumologic|SumoLogic query|\n|sumologic-cse|SumoLogic CSE query|\n|sumologic-cse-rule|SumoLogic CSE query|\n|sysmon|sysmon XML configuration|\n|uberagent|uberAgent ESA\'s process tagging rules|\n|xpack-watcher|X-Pack Watcher JSON for alerting|\n\n## Overview\n\nConversion Overview\n\n![Conversion Graph](/docs/images/conversion.png)\n\nPipelines\n\n![Conversion Graph](/docs/images/pipelines.png)\n\nMore details are described in [the documentation](https://sigmahq-pysigma.readthedocs.io/).\n\n## Testing\n\npySigma uses pytest as testing framework. Simply run `pytest` to run all tests. Run `pytest\n--cov=sigma` to get a coverage report.\n\n## Building\n\nTo build your own package run `poetry build`.\n\n## Contributing\n\nPull requests are welcome. Please feel free to lodge any issues/PRs as discussion points.\n\nThis [blog post](https://medium.com/@micahbabinski/creating-a-sigma-backend-for-fun-and-no-profit-ed16d20da142) by Micah Babinski explains the process from a developer\'s perspective. \n\n## Maintainers\n\nThe project is currently maintained by:\n\n- Thomas Patzke <thomas@patzke.org>\n- [frack113](https://github.com/frack113)\n\n## Related Projects\n\npySigma isn\'t a monolithic library attempting to support everything but the core. Support for target\nquery languages and log data models is provided by additional packages that extend pySigma:\n\n* [sigma-cli](https://github.com/SigmaHQ/sigma-cli): a command line interface for conversion of\n  Sigma rules based on pySigma.\n* [pySigma-backend-splunk](https://github.com/SigmaHQ/pySigma-backend-splunk)\n* [pySigma-pipeline-sysmon](https://github.com/SigmaHQ/pySigma-pipeline-sysmon)\n* [pySigma-pipeline-crowdstrike](https://github.com/SigmaHQ/pySigma-pipeline-crowdstrike)\n\nAll packages can also be installed from PyPI if not mentioned otherwise by the Python package\nmanager of your choice.\n\n## License\n\nGNU Lesser General Public License v2.1. For details, please see the full license file [located here](https://github.com/SigmaHQ/pySigma/blob/main/LICENSE).\n',
    'author': 'Thomas Patzke',
    'author_email': 'thomas@patzke.org',
    'maintainer': 'None',
    'maintainer_email': 'None',
    'url': 'https://github.com/SigmaHQ/pySigma',
    'packages': packages,
    'package_data': package_data,
    'install_requires': install_requires,
    'python_requires': '>=3.8,<4.0',
}


setup(**setup_kwargs)
