From 247d8a1a1052ce3bc802f0c7f7ba9849624e8bed Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Sun, 7 Aug 2022 18:03:36 +0200 Subject: [PATCH 01/10] python310Packages.pysigma-backend-insightidr: 0.1.6 -> 0.1.7 --- .../python-modules/pysigma-backend-insightidr/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix b/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix index 50b1e40852a2..c373a2fc6776 100644 --- a/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix +++ b/pkgs/development/python-modules/pysigma-backend-insightidr/default.nix @@ -10,7 +10,7 @@ buildPythonPackage rec { pname = "pysigma-backend-insightidr"; - version = "0.1.6"; + version = "0.1.7"; format = "pyproject"; disabled = pythonOlder "3.8"; @@ -19,7 +19,7 @@ buildPythonPackage rec { owner = "SigmaHQ"; repo = "pySigma-backend-insightidr"; rev = "refs/tags/v${version}"; - hash = "sha256-Sg+AYoEbCmcqxw5dl8wmQcI+lFrAfFgDnQjiQh6r9Yc="; + hash = "sha256-5uWSXUKLSJbkJHvMmFGrS/yukBO/ax8seg+0ZqAHdaE="; }; nativeBuildInputs = [ From 6254ae4d02fdbdb94edf4f455839b621c8a43299 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Sun, 7 Aug 2022 18:06:01 +0200 Subject: [PATCH 02/10] python310Packages.pysigma-pipeline-crowdstrike: 0.1.6 -> 0.1.7 --- .../python-modules/pysigma-pipeline-crowdstrike/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pysigma-pipeline-crowdstrike/default.nix b/pkgs/development/python-modules/pysigma-pipeline-crowdstrike/default.nix index 14129f148b19..d6207f7082a2 100644 --- a/pkgs/development/python-modules/pysigma-pipeline-crowdstrike/default.nix +++ b/pkgs/development/python-modules/pysigma-pipeline-crowdstrike/default.nix @@ -9,7 +9,7 @@ buildPythonPackage rec { pname = "pysigma-pipeline-crowdstrike"; - version = "0.1.6"; + version = "0.1.7"; format = "pyproject"; disabled = pythonOlder "3.8"; @@ -18,7 +18,7 @@ buildPythonPackage rec { owner = "SigmaHQ"; repo = "pySigma-pipeline-crowdstrike"; rev = "v${version}"; - hash = "sha256-5xX7NwM+Us0ToJa2miAw9KsCt2T+TqBnqHtwphZNxJI="; + hash = "sha256-cALpOAn+zf1w7KYExBVFebRwNYMjiQPE7fdB1x7gHZw="; }; nativeBuildInputs = [ From 7a08effb26f408f0fefd5ad2d94077043792c22a Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Sun, 7 Aug 2022 18:13:31 +0200 Subject: [PATCH 03/10] python310Packages.pysigma-pipeline-sysmon: 0.1.6 -> 1.0.0 --- .../python-modules/pysigma-pipeline-sysmon/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pysigma-pipeline-sysmon/default.nix b/pkgs/development/python-modules/pysigma-pipeline-sysmon/default.nix index d308d72d805f..23c9b5eef4d5 100644 --- a/pkgs/development/python-modules/pysigma-pipeline-sysmon/default.nix +++ b/pkgs/development/python-modules/pysigma-pipeline-sysmon/default.nix @@ -9,7 +9,7 @@ buildPythonPackage rec { pname = "pysigma-pipeline-sysmon"; - version = "0.1.6"; + version = "1.0.0"; format = "pyproject"; disabled = pythonOlder "3.8"; @@ -18,7 +18,7 @@ buildPythonPackage rec { owner = "SigmaHQ"; repo = "pySigma-pipeline-sysmon"; rev = "v${version}"; - hash = "sha256-hKXnM3iqt6PnV+cMV3gEleBChd263sy2DovpIKg22fs="; + hash = "sha256-OwWUt1O8436kmuaqv8Ec6485NLkVztLjGIWF2SPRtKA="; }; nativeBuildInputs = [ From 7c68a4bed4a40717b8133c284dc3f1d4033fcc8c Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Sun, 7 Aug 2022 19:05:54 +0200 Subject: [PATCH 04/10] python310Packages.pysigma-backend-elasticsearch: init at 0.1.0 --- .../pysigma-backend-elasticsearch/default.nix | 53 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 55 insertions(+) create mode 100644 pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix diff --git a/pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix b/pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix new file mode 100644 index 000000000000..7ec64df2e1b8 --- /dev/null +++ b/pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix @@ -0,0 +1,53 @@ +{ lib +, buildPythonPackage +, fetchFromGitHub +, poetry-core +, pysigma +, pytestCheckHook +, pythonOlder +, requests +}: + +buildPythonPackage rec { + pname = "pysigma-backend-elasticsearch"; + version = "0.1.0"; + format = "pyproject"; + + disabled = pythonOlder "3.8"; + + src = fetchFromGitHub { + owner = "SigmaHQ"; + repo = "pySigma-backend-elasticsearch"; + rev = "v${version}"; + hash = "sha256-BEvYz0jTJifsNBrA4r16JkiFaERDj/zWKd9MbhcuCS8="; + }; + + nativeBuildInputs = [ + poetry-core + ]; + + propagatedBuildInputs = [ + pysigma + ]; + + checkInputs = [ + pytestCheckHook + requests + ]; + + pythonImportsCheck = [ + "sigma.backends.elasticsearch" + ]; + + disabledTests = [ + # Tests requires network access + "test_connect_lucene" + ]; + + meta = with lib; { + description = "Library to support Elasticsearch for pySigma"; + homepage = "https://github.com/SigmaHQ/pySigma-backend-elasticsearch"; + license = with licenses; [ lgpl21Only ]; + maintainers = with maintainers; [ fab ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 8b01d2c424d1..5c831e4466b7 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -8196,6 +8196,8 @@ in { pysigma = callPackage ../development/python-modules/pysigma { }; + pysigma-backend-elasticsearch = callPackage ../development/python-modules/pysigma-backend-elasticsearch { }; + pysigma-backend-splunk = callPackage ../development/python-modules/pysigma-backend-splunk { }; pysigma-backend-insightidr = callPackage ../development/python-modules/pysigma-backend-insightidr { }; From df69944407b78a25f3291153b38e2ecf4e7ad76b Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Sun, 7 Aug 2022 19:16:27 +0200 Subject: [PATCH 05/10] python310Packages.pysigma-backend-opensearch: init at 0.1.2 --- .../pysigma-backend-opensearch/default.nix | 55 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 57 insertions(+) create mode 100644 pkgs/development/python-modules/pysigma-backend-opensearch/default.nix diff --git a/pkgs/development/python-modules/pysigma-backend-opensearch/default.nix b/pkgs/development/python-modules/pysigma-backend-opensearch/default.nix new file mode 100644 index 000000000000..36e44c629855 --- /dev/null +++ b/pkgs/development/python-modules/pysigma-backend-opensearch/default.nix @@ -0,0 +1,55 @@ +{ lib +, buildPythonPackage +, fetchFromGitHub +, poetry-core +, pysigma +, pysigma-backend-elasticsearch +, pytestCheckHook +, pythonOlder +, requests +}: + +buildPythonPackage rec { + pname = "pysigma-backend-opensearch"; + version = "0.1.2"; + format = "pyproject"; + + disabled = pythonOlder "3.8"; + + src = fetchFromGitHub { + owner = "SigmaHQ"; + repo = "pySigma-backend-opensearch"; + rev = "v${version}"; + hash = "sha256-5+/LOi7GHu8h9WhjpZ7bBc4aM41NiXrSrdGhbXdYMvw="; + }; + + nativeBuildInputs = [ + poetry-core + ]; + + propagatedBuildInputs = [ + pysigma + pysigma-backend-elasticsearch + ]; + + checkInputs = [ + pytestCheckHook + requests + ]; + + pythonImportsCheck = [ + "sigma.backends.opensearch" + ]; + + disabledTests = [ + # Tests requires network access + "test_connect_lucene" + ]; + + meta = with lib; { + description = "Library to support OpenSearch for pySigma"; + homepage = "https://github.com/SigmaHQ/pySigma-backend-opensearch"; + license = with licenses; [ lgpl21Only ]; + maintainers = with maintainers; [ fab ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 5c831e4466b7..76ab4a8a7470 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -8198,6 +8198,8 @@ in { pysigma-backend-elasticsearch = callPackage ../development/python-modules/pysigma-backend-elasticsearch { }; + pysigma-backend-opensearch = callPackage ../development/python-modules/pysigma-backend-opensearch { }; + pysigma-backend-splunk = callPackage ../development/python-modules/pysigma-backend-splunk { }; pysigma-backend-insightidr = callPackage ../development/python-modules/pysigma-backend-insightidr { }; From fa2dcbcc772a2dd484989156982e8f35bbe38601 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Sun, 7 Aug 2022 19:28:05 +0200 Subject: [PATCH 06/10] python310Packages.pysigma-backend-qradar: init at 0.1.9 --- .../pysigma-backend-qradar/default.nix | 49 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 51 insertions(+) create mode 100644 pkgs/development/python-modules/pysigma-backend-qradar/default.nix diff --git a/pkgs/development/python-modules/pysigma-backend-qradar/default.nix b/pkgs/development/python-modules/pysigma-backend-qradar/default.nix new file mode 100644 index 000000000000..348dd6991a5b --- /dev/null +++ b/pkgs/development/python-modules/pysigma-backend-qradar/default.nix @@ -0,0 +1,49 @@ +{ lib +, buildPythonPackage +, fetchFromGitHub +, poetry-core +, pysigma +, pysigma-pipeline-sysmon +, pytestCheckHook +, pythonOlder +, requests +}: + +buildPythonPackage rec { + pname = "pysigma-backend-qradar"; + version = "0.1.9"; + format = "pyproject"; + + disabled = pythonOlder "3.8"; + + src = fetchFromGitHub { + owner = "nNipsx-Sec"; + repo = "pySigma-backend-qradar"; + rev = "v${version}"; + hash = "sha256-b3e8cVrVFZgihhEk6QlUnRZigglczHUa/XeMvMzNYLk="; + }; + + nativeBuildInputs = [ + poetry-core + ]; + + propagatedBuildInputs = [ + pysigma + ]; + + checkInputs = [ + pysigma-pipeline-sysmon + pytestCheckHook + ]; + + pythonImportsCheck = [ + "sigma.backends.qradar" + ]; + + meta = with lib; { + description = "Library to support Qradar for pySigma"; + homepage = "https://github.com/nNipsx-Sec/pySigma-backend-qradar"; + license = with licenses; [ lgpl21Only ]; + maintainers = with maintainers; [ fab ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 76ab4a8a7470..17ebd0e5e74e 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -8200,6 +8200,8 @@ in { pysigma-backend-opensearch = callPackage ../development/python-modules/pysigma-backend-opensearch { }; + pysigma-backend-qradar = callPackage ../development/python-modules/pysigma-backend-qradar { }; + pysigma-backend-splunk = callPackage ../development/python-modules/pysigma-backend-splunk { }; pysigma-backend-insightidr = callPackage ../development/python-modules/pysigma-backend-insightidr { }; From 934b565dd7f7b90ac3b996c64f1270dc0eb13896 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Sun, 7 Aug 2022 19:29:15 +0200 Subject: [PATCH 07/10] sigma-cli: 0.4.3 -> 0.5.0 --- pkgs/tools/security/sigma-cli/default.nix | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/pkgs/tools/security/sigma-cli/default.nix b/pkgs/tools/security/sigma-cli/default.nix index 5a3ed90a4182..8b10d6412d1c 100644 --- a/pkgs/tools/security/sigma-cli/default.nix +++ b/pkgs/tools/security/sigma-cli/default.nix @@ -5,14 +5,14 @@ python3.pkgs.buildPythonApplication rec { pname = "sigma-cli"; - version = "0.4.3"; + version = "0.5.0"; format = "pyproject"; src = fetchFromGitHub { owner = "SigmaHQ"; repo = pname; rev = "refs/tags/v${version}"; - hash = "sha256-3LFakeS3aQaacm7HqeAJPMJhi3Wf8zbJc//SEWUA1Rg="; + hash = "sha256-i0rin4TLoqo+F2nWG4kcFp3x/cRtkMzAo5Ldyo0Si5w="; }; nativeBuildInputs = with python3.pkgs; [ @@ -23,8 +23,11 @@ python3.pkgs.buildPythonApplication rec { click prettytable pysigma - pysigma-backend-splunk + pysigma-backend-elasticsearch pysigma-backend-insightidr + pysigma-backend-opensearch + pysigma-backend-qradar + pysigma-backend-splunk pysigma-pipeline-crowdstrike pysigma-pipeline-sysmon pysigma-pipeline-windows @@ -37,7 +40,7 @@ python3.pkgs.buildPythonApplication rec { postPatch = '' substituteInPlace pyproject.toml \ --replace 'prettytable = "^3.1.1"' 'prettytable = "*"' \ - --replace 'pysigma = "^0.5.0"' 'pysigma = "*"' + --replace 'pysigma = "^0.7.2"' 'pysigma = "*"' ''; pythonImportsCheck = [ From 742a1df5989da75962e80a40b01371e886157c9e Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Sun, 7 Aug 2022 20:48:54 +0200 Subject: [PATCH 08/10] python310Packages.pysigma: 0.6.8 -> 0.7.3 --- pkgs/development/python-modules/pysigma/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pysigma/default.nix b/pkgs/development/python-modules/pysigma/default.nix index a125c68dbf98..b75df650acdf 100644 --- a/pkgs/development/python-modules/pysigma/default.nix +++ b/pkgs/development/python-modules/pysigma/default.nix @@ -11,7 +11,7 @@ buildPythonPackage rec { pname = "pysigma"; - version = "0.6.8"; + version = "0.7.3"; format = "pyproject"; disabled = pythonOlder "3.8"; @@ -20,7 +20,7 @@ buildPythonPackage rec { owner = "SigmaHQ"; repo = "pySigma"; rev = "refs/tags/v${version}"; - hash = "sha256-Jq37/9w1GHr+GZ8Fvftmfz2XkL3zUpTjbDlokrUoLtw="; + hash = "sha256-yXzYNBD39dPd2f5Gvmo5p0cVlTy38q1jnBL+HjAxmB8="; }; nativeBuildInputs = [ From 35d5a693754454795a72fe2c764f241445551886 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Sun, 7 Aug 2022 20:53:25 +0200 Subject: [PATCH 09/10] python310Packages.pysigma-pipeline-windows: 0.1.1 -> 1.0.0 --- .../python-modules/pysigma-pipeline-windows/default.nix | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/pkgs/development/python-modules/pysigma-pipeline-windows/default.nix b/pkgs/development/python-modules/pysigma-pipeline-windows/default.nix index 7620f84a97e5..98808b6090a2 100644 --- a/pkgs/development/python-modules/pysigma-pipeline-windows/default.nix +++ b/pkgs/development/python-modules/pysigma-pipeline-windows/default.nix @@ -9,7 +9,7 @@ buildPythonPackage rec { pname = "pysigma-pipeline-windows"; - version = "0.1.1"; + version = "1.0.0"; format = "pyproject"; disabled = pythonOlder "3.8"; @@ -18,7 +18,7 @@ buildPythonPackage rec { owner = "SigmaHQ"; repo = "pySigma-pipeline-windows"; rev = "refs/tags/v${version}"; - hash = "sha256-ATDWhHY9tjuQbfIFgoGhz8qsluH9hTSI9zdPmP8GPWE="; + hash = "sha256-/DUhgvcGhk28HRDCi96K1NH6MHNB1WogfuMVCgNbot4="; }; nativeBuildInputs = [ @@ -29,11 +29,6 @@ buildPythonPackage rec { pysigma ]; - postPatch = '' - substituteInPlace pyproject.toml \ - --replace 'pysigma = "^0.5.0"' 'pysigma = "^0.6.0"' - ''; - checkInputs = [ pytestCheckHook ]; From 14bb6740bf0f5ed39122c1bd1c7d7ce096e8c8fc Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Sun, 7 Aug 2022 20:59:41 +0200 Subject: [PATCH 10/10] python310Packages.pysigma-backend-splunk: 0.3.5 -> 0.3.6 --- .../python-modules/pysigma-backend-splunk/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pysigma-backend-splunk/default.nix b/pkgs/development/python-modules/pysigma-backend-splunk/default.nix index 7f7539973ab3..b44baae526b0 100644 --- a/pkgs/development/python-modules/pysigma-backend-splunk/default.nix +++ b/pkgs/development/python-modules/pysigma-backend-splunk/default.nix @@ -10,7 +10,7 @@ buildPythonPackage rec { pname = "pysigma-backend-splunk"; - version = "0.3.5"; + version = "0.3.6"; format = "pyproject"; disabled = pythonOlder "3.8"; @@ -19,7 +19,7 @@ buildPythonPackage rec { owner = "SigmaHQ"; repo = "pySigma-backend-splunk"; rev = "refs/tags/v${version}"; - hash = "sha256-W6wnxQPrtMDG5jctB7CMXr4kPIhZievFTBJCeSeDCWw="; + hash = "sha256-6XvKytODJll9BPeAhk6girwLibNJk+QEn2AV/WNqnyI="; }; nativeBuildInputs = [