pySigma
pySigma copied to clipboard
sigma.exceptions.SigmaValueError: Can't merge value lists '<field>' into one item due to different logical linking.
Hello, I tried to convert a Sigma rule but got this weird error when calling .to_dict()
on it. I feel like it should work?
from sigma.rule import SigmaRule
sigma_rule = r"""
title: AAAAAAAAAA
id: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
status: experimental
level: high
logsource:
product: AAAA
detection:
exclusions:
- D:
- '5'
- '6'
C:
- '3'
- '4'
- D: '2'
E:
- '1'
condition: not exclusions
"""
import yaml
rule = SigmaRule.from_dict(yaml.safe_load(sigma_rule))
rule.to_dict()
Here is the error:
Traceback (most recent call last):
File "REDACTED\scratch_8.py", line 29, in <module>
rule.to_dict()
File "REDACTED\pySigma\sigma\rule.py", line 1186, in to_dict
"detection": self.detection.to_dict(),
^^^^^^^^^^^^^^^^^^^^^^^^
File "REDACTED\pySigma\sigma\rule.py", line 707, in to_dict
identifier: detection.to_plain() for identifier, detection in self.detections.items()
^^^^^^^^^^^^^^^^^^^^
File "REDACTED\pySigma\sigma\rule.py", line 602, in to_plain
raise sigma_exceptions.SigmaValueError(
sigma.exceptions.SigmaValueError: Can't merge value lists 'D' into one item due to different logical linking.
Any idea?