#!/usr/bin/env python3
"""Extract fenced Sigma YAML blocks from a Markdown SKILL file to files.

A block counts as Sigma if it contains both 'detection:' and 'logsource:'.
Placeholder rules (id: xxxxxxxx...) are skipped so `sigma check` only sees
real, validatable content.

Usage: python3 extract_rules.py <SKILL.md> <out-prefix>   # -> <prefix>1.yml, ...
"""
import re
import sys

md, prefix = sys.argv[1], sys.argv[2]
text = open(md, encoding="utf-8").read()
blocks = re.findall(r"```ya?ml\n(.*?)```", text, re.S)
n = 0
for b in blocks:
    if "detection:" in b and "logsource:" in b:
        if not re.search(r"id:\s*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}", b):
            continue  # skip the structure-template block; keep only rules with a real UUID
        n += 1
        open(f"{prefix}{n}.yml", "w").write(b)
print(f"extracted {n} sigma rule(s)")