(rule_text, sigma_config=None)
return rule_return
Returns a JSON represenation for a rule

    Args:
        rule_text: Text of the sigma rule to be parsed
        sigma_config: config file object

    Returns:
        Json representation of the parsed rule
    Raises:
        sigma_exceptions.SigmaParseError: Issue with parsing the given rule
        yaml.parser.ParserError: Not a correct YAML text provided
        NotImplementedError: A feature in the provided Sigma rule is not
            implemented in Sigma for Timesketch
Returns a JSON represenation for a rule
Returns a JSON represenation for a rule
def get_sigma_rule_by_text(rule_text, sigma_config=None):
    """Returns a JSON represenation for a rule

    Args:
        rule_text: Text of the sigma rule to be parsed
        sigma_config: config file object

    Returns:
        Json representation of the parsed rule
    Raises:
        sigma_exceptions.SigmaParseError: Issue with parsing the given rule
        yaml.parser.ParserError: Not a correct YAML text provided
        NotImplementedError: A feature in the provided Sigma rule is not
            implemented in Sigma for Timesketch
    """

    try:
        if isinstance(sigma_config, sigma_configuration.SigmaConfiguration):
            sigma_conf_obj = sigma_config
        elif isinstance(sigma_config, str):
            sigma_conf_obj = get_sigma_config_file(sigma_config)
        else:
            sigma_conf_obj = get_sigma_config_file()
    except ValueError as e:
        logger.error(
            'Problem reading the Sigma config', exc_info=True)
        raise ValueError('Problem reading the Sigma config') from e

    sigma_backend = sigma_es.ElasticsearchQuerystringBackend(
        sigma_conf_obj, {})

    rule_return = {}
    # TODO check if input validation is needed / useful.
    try:
        rule_yaml_data = yaml.safe_load_all(rule_text)

        for doc in rule_yaml_data:

            parser = sigma_collection.SigmaCollectionParser(
                str(doc), sigma_conf_obj, None)
            parsed_sigma_rules = parser.generate(sigma_backend)
            rule_return.update(doc)

    except NotImplementedError as exception:
        logger.error(
            'Error generating rule {0!s}'.format(exception))
        raise

    except sigma_exceptions.SigmaParseError as exception:
        logger.error(
            'Sigma parsing error generating rule {0!s}'
            .format(exception))
        raise

    except yaml.parser.ParserError as exception:
        logger.error(
            'Yaml parsing error generating rule {0!s}'.format(exception))
        raise

    sigma_es_query = ''

    for sigma_rule in parsed_sigma_rules:
        sigma_es_query = _sanatize_sigma_rule(sigma_rule)

    rule_return.update(
        {'es_query': sigma_es_query})
    rule_return.update(
        {'file_name': 'N/A'})
    rule_return.update(
        {'file_relpath': 'N/A'})
    logger.error(rule_return)
    return rule_return
def get_sigma_rule_by_text ( rule_text , sigma_config = None ) : try : if isinstance ( sigma_config , sigma_configuration . SigmaConfiguration ) : sigma_conf_obj = sigma_config elif isinstance ( sigma_config , str ) : sigma_conf_obj = get_sigma_config_file ( sigma_config ) else : sigma_conf_obj = get_sigma_config_file ( ) except ValueError as e : logger . error ( 'Problem reading the Sigma config' , exc_info = True ) raise ValueError ( 'Problem reading the Sigma config' ) from e sigma_backend = sigma_es . ElasticsearchQuerystringBackend ( sigma_conf_obj , { } ) rule_return = { } # TODO check if input validation is needed / useful. try : rule_yaml_data = yaml . safe_load_all ( rule_text ) for doc in rule_yaml_data : parser = sigma_collection . SigmaCollectionParser ( str ( doc ) , sigma_conf_obj , None ) parsed_sigma_rules = parser . generate ( sigma_backend ) rule_return . update ( doc ) except NotImplementedError as exception : logger . error ( 'Error generating rule {0!s}' . format ( exception ) ) raise except sigma_exceptions . SigmaParseError as exception : logger . error ( 'Sigma parsing error generating rule {0!s}' . format ( exception ) ) raise except yaml . parser . ParserError as exception : logger . error ( 'Yaml parsing error generating rule {0!s}' . format ( exception ) ) raise sigma_es_query = '' for sigma_rule in parsed_sigma_rules : sigma_es_query = _sanatize_sigma_rule ( sigma_rule ) rule_return . update ( { 'es_query' : sigma_es_query } ) rule_return . update ( { 'file_name' : 'N/A' } ) rule_return . update ( { 'file_relpath' : 'N/A' } ) logger . error ( rule_return ) return rule_return