parser-common: recognize events produced by SIGMA checkers

Resolves: https://issues.redhat.com/browse/OSH-539 Closes: csutils#159
kdudka · Jan 31, 2024 · 15bf46e · 15bf46e
1 parent b9453dc
commit 15bf46e
Show file tree

Hide file tree

Showing 5 changed files with 923 additions and 1 deletion.
diff --git a/src/lib/parser-common.hh b/src/lib/parser-common.hh
@@ -35,7 +35,8 @@
 
 #define RE_EVENT_GCC "(?:(?:(?:fatal|internal|runtime) )?[A-Za-z][A-Za-z0-9_-]+)(?:\\[[^ \\]]+\\])?"
 #define RE_EVENT_PROSPECTOR "(?:[A-Z]+[0-9]+\\[[a-z0-9-]+\\])"
-#define RE_EVENT RE_EVENT_GCC "|" RE_EVENT_PROSPECTOR
+#define RE_EVENT_SIGMA "(?:Sigma (?:main )?event)"
+#define RE_EVENT RE_EVENT_GCC "|" RE_EVENT_PROSPECTOR "|" RE_EVENT_SIGMA
 
 int parse_int(const std::string &, int fallback = 0);
 

diff --git a/tests/csgrep/0119-cov-parser-sigma-args.txt b/tests/csgrep/0119-cov-parser-sigma-args.txt
@@ -0,0 +1 @@
+--mode=json