From 5eccb67798663f6a5d61c1f670ed189e63060c76 Mon Sep 17 00:00:00 2001 From: Cyril Poder Date: Wed, 23 Sep 2026 03:54:38 +0200 Subject: [PATCH] engine: Varpulis at 9e92c0b, the fixes found converting Sigma Detect units run the Varpulis engine at varpulis/varpulis main 9e92c0b (#277, #279, #281, #282) instead of 8bbeffc: a closure followed by a step no longer matches before the step, .stnm() keeps an event from opening a second run, a condition on a missing field is false in .where() as in a sequence step, a top-level let/const is what a stream reads, and a lambda, `a?.b` or a timestamp literal no longer aborts the process. vpl-check and the MCP tool run the engine's semantic validator. VPL gains raw single-quoted strings, regex_match and backticked field names, so rules converted by `sigma convert -t varpulis` run as detect units. No Vejas code change. The repository's four detect programs pass the validating check; cargo test 43 passed. Co-Authored-By: Claude Opus 5.5 (1M context) --- CHANGELOG.md | 29 +++++++++++++++++++++++++++++ core/Cargo.lock | 22 ++++++++++++---------- core/Cargo.toml | 2 +- 3 files changed, 42 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2cf592a..d4e9dbd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,35 @@ is `0`, minor versions may carry breaking changes — they are called out here. ## [Unreleased] +### Fixed — detect units, from the Varpulis engine (varpulis #277, #279, #281) +- **A sequence with a closure followed by a step** (`A -> all B -> C`) no + longer matches before C. Under the default `.each()` it emitted a complete + match at every B, with or without a C; the brute-force example alerted on + failed logins alone. Matches now come when C arrives, one per closure event. +- **`.stnm()` now keeps an event from opening a second run** when a run + already took it, so `.stnm().longest()` makes one alert of a brute force of + any length. +- **A condition on a field the event does not carry is false** in `.where()`, + as it was in a sequence step: `a == "x" or ends_with(b, "y")` fired only + when `b` was present, and `selection and not filter` dropped events lacking + the filter's field. +- **A program with a lambda (`arr.filter(x => ...)`), `a?.b` or a timestamp + literal no longer aborts the process** with a stack overflow, which took + every unit of the runtime down with it. +- **`vejas-runtime vpl-check` and the MCP tool `vejas_vpl_check` run the + engine's semantic validator**: an unknown function (E050), a misspelled + event type once types are declared (E033), a regular expression that cannot + compile (E052) and an unbounded closure (W003, a warning) are reported with + their line. They checked parse and load only. + +### Added — in VPL +- Single-quoted raw strings (`'\AppData\Local\Temp\'`, `''` for a quote), + `regex_match(s, pattern)`, and backticked field names (`` `cs-uri-query` ``) + for web and proxy logs. With them, rules converted from Sigma by + `sigma convert -t varpulis` + ([pySigma-backend-varpulis](https://github.com/varpulis/pySigma-backend-varpulis)) + run as detect units. + ## [0.3.0] — 2026-09-22 ### Added diff --git a/core/Cargo.lock b/core/Cargo.lock index ef3eb06..65dc0dc 100644 --- a/core/Cargo.lock +++ b/core/Cargo.lock @@ -1846,11 +1846,12 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be" [[package]] name = "varpulis-core" version = "0.11.0" -source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2" +source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf" dependencies = [ "chrono", "indexmap", "miette", + "regex", "rustc-hash", "schemars", "serde", @@ -1862,7 +1863,7 @@ dependencies = [ [[package]] name = "varpulis-dead-letter" version = "0.11.0" -source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2" +source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf" dependencies = [ "chrono", "serde", @@ -1874,7 +1875,7 @@ dependencies = [ [[package]] name = "varpulis-engine" version = "0.11.0" -source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2" +source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf" dependencies = [ "serde_json", "thiserror", @@ -1886,7 +1887,7 @@ dependencies = [ [[package]] name = "varpulis-hamlet" version = "0.11.0" -source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2" +source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf" dependencies = [ "rustc-hash", "smallvec", @@ -1897,7 +1898,7 @@ dependencies = [ [[package]] name = "varpulis-parser" version = "0.11.0" -source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2" +source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf" dependencies = [ "logos", "miette", @@ -1910,7 +1911,7 @@ dependencies = [ [[package]] name = "varpulis-pst" version = "0.11.0" -source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2" +source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf" dependencies = [ "hashlink", "rustc-hash", @@ -1920,13 +1921,14 @@ dependencies = [ [[package]] name = "varpulis-runtime" version = "0.11.0" -source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2" +source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf" dependencies = [ "chrono", "hashlink", "hex", "indexmap", "rand 0.10.3", + "regex", "rustc-hash", "serde", "serde_json", @@ -1947,7 +1949,7 @@ dependencies = [ [[package]] name = "varpulis-sase" version = "0.11.0" -source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2" +source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf" dependencies = [ "chrono", "rustc-hash", @@ -1959,7 +1961,7 @@ dependencies = [ [[package]] name = "varpulis-simd" version = "0.11.0" -source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2" +source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf" dependencies = [ "varpulis-core", ] @@ -1967,7 +1969,7 @@ dependencies = [ [[package]] name = "varpulis-zdd" version = "0.11.0" -source = "git+https://github.com/varpulis/varpulis?rev=8bbeffc9130ff4f6938420da5afa1bcc580100b2#8bbeffc9130ff4f6938420da5afa1bcc580100b2" +source = "git+https://github.com/varpulis/varpulis?rev=9e92c0bfaa748217edbb571b9fb4992d731ea0bf#9e92c0bfaa748217edbb571b9fb4992d731ea0bf" dependencies = [ "rustc-hash", ] diff --git a/core/Cargo.toml b/core/Cargo.toml index 2f04572..ae9ab8d 100644 --- a/core/Cargo.toml +++ b/core/Cargo.toml @@ -22,7 +22,7 @@ webpki-roots = "0.26" # The Varpulis CEP engine, embedded as a library (ADR-0031): compile a VPL # program, feed it events, publish its emits. No async runtime in its tree — # its own CI (scripts/check-engine-deps.py) fails if one ever appears. -varpulis-engine = { git = "https://github.com/varpulis/varpulis", rev = "8bbeffc9130ff4f6938420da5afa1bcc580100b2" } +varpulis-engine = { git = "https://github.com/varpulis/varpulis", rev = "9e92c0bfaa748217edbb571b9fb4992d731ea0bf" } [[bin]] name = "vejas-runtime"