pySigma icon indicating copy to clipboard operation
pySigma copied to clipboard

sigma.exceptions.SigmaValueError: Can't merge value lists '<field>' into one item due to different logical linking.

Open Res260 opened this issue 7 months ago • 6 comments

Hello, I tried to convert a Sigma rule but got this weird error when calling .to_dict() on it. I feel like it should work?

from sigma.rule import SigmaRule

sigma_rule = r"""
title: AAAAAAAAAA
id: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
status: experimental
level: high
logsource:
  product: AAAA
detection:
  exclusions:
    - D:
        - '5'
        - '6'
      C:
        - '3'
        - '4'

    - D: '2'
      E:
        - '1'
      
  condition: not exclusions
"""


import yaml
rule = SigmaRule.from_dict(yaml.safe_load(sigma_rule))
rule.to_dict()

Here is the error:

Traceback (most recent call last):
  File "REDACTED\scratch_8.py", line 29, in <module>
    rule.to_dict()
  File "REDACTED\pySigma\sigma\rule.py", line 1186, in to_dict
    "detection": self.detection.to_dict(),
                 ^^^^^^^^^^^^^^^^^^^^^^^^
  File "REDACTED\pySigma\sigma\rule.py", line 707, in to_dict
    identifier: detection.to_plain() for identifier, detection in self.detections.items()
                ^^^^^^^^^^^^^^^^^^^^
  File "REDACTED\pySigma\sigma\rule.py", line 602, in to_plain
    raise sigma_exceptions.SigmaValueError(
sigma.exceptions.SigmaValueError: Can't merge value lists 'D' into one item due to different logical linking.

Any idea?

Res260 avatar Jul 23 '24 21:07 Res260