(rule_folder, sigma_config=None)
return return_array
Returns the Sigma rules for a folder including subfolders.
    Args:
        rule_folder: folder to be checked for rules
        sigma_config: optional argument to pass a
                sigma.configuration.SigmaConfiguration object
    Returns:
        A array of Sigma rules as JSON
    Raises:
        ValueError: If SIGMA_RULES_FOLDERS is not found in the config file.
            or the folders are not readabale.
Returns the Sigma rules for a folder including subfolders.
    Args:
        rule_folder: folder to be checked for rules
        sigma_config: optional argument to pass a
                sigma.configuration.SigmaConfiguration object
    Returns:
        A array of Sigma rules as JSON
    Raises:
        ValueError: If SIGMA_RULES_FOLDERS is not found in the config file.
            or the folders are not readabale.
Returns the Sigma rules for a folder including subfolders . Args : rule_folder : folder to be checked for rules sigma_config : optional argument to pass a sigma . configuration . SigmaConfiguration object Returns : A array of Sigma rules as JSON Raises : ValueError : If SIGMA_RULES_FOLDERS is not found in the config file . or the folders are not readabale .
def get_sigma_rules(rule_folder, sigma_config=None):
    """Returns the Sigma rules for a folder including subfolders.
    Args:
        rule_folder: folder to be checked for rules
        sigma_config: optional argument to pass a
                sigma.configuration.SigmaConfiguration object
    Returns:
        A array of Sigma rules as JSON
    Raises:
        ValueError: If SIGMA_RULES_FOLDERS is not found in the config file.
            or the folders are not readabale.
    """
    return_array = []

    blocklist_path = None
    ignore = get_sigma_blocklist(blocklist_path)
    ignore_list = list(ignore['path'].unique())

    for dirpath, dirnames, files in os.walk(rule_folder):
        if 'deprecated' in [x.lower() for x in dirnames]:
            dirnames.remove('deprecated')

        for rule_filename in files:
            if rule_filename.lower().endswith('.yml'):
                # if a sub dir is found, do not try to parse it.
                if os.path.isdir(os.path.join(dirpath, rule_filename)):
                    continue

                rule_file_path = os.path.join(dirpath, rule_filename)

                if any(x in rule_file_path for x in ignore_list):
                    continue

                parsed_rule = get_sigma_rule(rule_file_path, sigma_config)
                if parsed_rule:
                    return_array.append(parsed_rule)
    return return_array
def get_sigma_rules ( rule_folder , sigma_config = None ) : return_array = [ ] blocklist_path = None ignore = get_sigma_blocklist ( blocklist_path ) ignore_list = list ( ignore [ 'path' ] . unique ( ) ) for dirpath , dirnames , files in os . walk ( rule_folder ) : if 'deprecated' in [ x . lower ( ) for x in dirnames ] : dirnames . remove ( 'deprecated' ) for rule_filename in files : if rule_filename . lower ( ) . endswith ( '.yml' ) : # if a sub dir is found, do not try to parse it. if os . path . isdir ( os . path . join ( dirpath , rule_filename ) ) : continue rule_file_path = os . path . join ( dirpath , rule_filename ) if any ( x in rule_file_path for x in ignore_list ) : continue parsed_rule = get_sigma_rule ( rule_file_path , sigma_config ) if parsed_rule : return_array . append ( parsed_rule ) return return_array