engine: Varpulis at 9e92c0b, the fixes found converting Sigma - #2
Merged
Merged
Conversation
Detect units run the Varpulis engine at varpulis/varpulis main 9e92c0b (#277, #279, #281, #282) instead of 8bbeffc: a closure followed by a step no longer matches before the step, .stnm() keeps an event from opening a second run, a condition on a missing field is false in .where() as in a sequence step, a top-level let/const is what a stream reads, and a lambda, `a?.b` or a timestamp literal no longer aborts the process. vpl-check and the MCP tool run the engine's semantic validator. VPL gains raw single-quoted strings, regex_match and backticked field names, so rules converted by `sigma convert -t varpulis` run as detect units. No Vejas code change. The repository's four detect programs pass the validating check; cargo test 43 passed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves detect units to the Varpulis engine at varpulis/varpulis main after #277, #279, #281 and #282 (from 8bbeffc). What changes for a unit, all in CHANGELOG
[Unreleased]:A -> all B -> Cno longer matches before C (the brute-force example alerted on failed logins alone);.stnm()keeps an event from opening a second run (.stnm().longest()= one alert per attack); a condition on a field the event does not carry is false in.where()as in a sequence step; a top-levellet/constis what a stream reads under that name.arr.filter(x => ...)),a?.bor a timestamp literal no longer aborts the process with a stack overflow, which took every unit down with it.vejas-runtime vpl-checkand the MCP toolvejas_vpl_checknow run the engine's semantic validator (E050 unknown function, E033 misspelled event type once types are declared, E052 regex that cannot compile, W003 unbounded closure).regex_match, backticked field names; with them, rules converted bysigma convert -t varpulis(https://github.com/varpulis/pySigma-backend-varpulis) run as detect units.No Vejas code change: the engine's
Erroris#[non_exhaustive]and the newInvalidvariant reachesvpl-checkthroughto_string(). The detect programs in this repository (e2e, demo, bench) pass the validating check.cargo test: 43 passed locally; the e2e jobs run on NATS in CI.🤖 Generated with Claude Code