parser-common: recognize events produced by SIGMA checkers

Resolves: https://issues.redhat.com/browse/OSH-539 Closes: #159
csutils · Jan 31, 2024 · 96bea42 · 96bea42
1 parent 941ad1a
commit 96bea42
Show file tree

Hide file tree

Showing 5 changed files with 923 additions and 1 deletion.
diff --git a/src/lib/parser-common.hh b/src/lib/parser-common.hh
@@ -35,7 +35,8 @@
 
 #define RE_EVENT_GCC "(?:(?:(?:fatal|internal|runtime) )?[A-Za-z][A-Za-z0-9_-]+)(?:\\[[^ \\]]+\\])?"
 #define RE_EVENT_PROSPECTOR "(?:[A-Z]+[0-9]+\\[[a-z0-9-]+\\])"
-#define RE_EVENT RE_EVENT_GCC "|" RE_EVENT_PROSPECTOR
+#define RE_EVENT_SIGMA "(?:Sigma (?:main )?event)"
+#define RE_EVENT RE_EVENT_GCC "|" RE_EVENT_PROSPECTOR "|" RE_EVENT_SIGMA
 
 int parse_int(const std::string &, int fallback = 0);
 

diff --git a/tests/csgrep/0119-cov-parser-sigma-args.txt b/tests/csgrep/0119-cov-parser-sigma-args.txt
@@ -0,0 +1 @@
+--mode=json