24 lines
918 B
Python
Executable File
24 lines
918 B
Python
Executable File
#!/usr/bin/env python3
|
|
"""Extract fenced Sigma YAML blocks from a Markdown SKILL file to files.
|
|
|
|
A block counts as Sigma if it contains both 'detection:' and 'logsource:'.
|
|
Placeholder rules (id: xxxxxxxx...) are skipped so `sigma check` only sees
|
|
real, validatable content.
|
|
|
|
Usage: python3 extract_rules.py <SKILL.md> <out-prefix> # -> <prefix>1.yml, ...
|
|
"""
|
|
import re
|
|
import sys
|
|
|
|
md, prefix = sys.argv[1], sys.argv[2]
|
|
text = open(md, encoding="utf-8").read()
|
|
blocks = re.findall(r"```ya?ml\n(.*?)```", text, re.S)
|
|
n = 0
|
|
for b in blocks:
|
|
if "detection:" in b and "logsource:" in b:
|
|
if not re.search(r"id:\s*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}", b):
|
|
continue # skip the structure-template block; keep only rules with a real UUID
|
|
n += 1
|
|
open(f"{prefix}{n}.yml", "w").write(b)
|
|
print(f"extracted {n} sigma rule(s)")
|