Schema definition clarification/mod needed about sigma HOT 4 CLOSED

Actually there are few discrepancies between the schema and the rules every now and then ... author is defined as str, but here it's a list:
https://github.com/Neo23x0/sigma/blob/master/rules/windows/sysmon/sysmon_susp_certutil_command.yml

Sorry for bringing this over and over, I already do check for those issues in the code that parses the rules, but consistency between the schema and the sample rules will make a better case for wider sigma adoption.

from sigma.

Factually, sigmac currently implements A, but the specification defines str. Fixing it to str and adding the or syntax to conditions would make the parsing harder and the condition harder to read in my opinion. Same for author: list-only would add unneeded single-item lists to many rules while str-only will make rules with multiple authors unstructured.

On the whole, I think we should keep this flexibility in Sigma and allow str and list. Unfortunately, the used Schema language (Kwalify) doesn't support such alternatives, while Rx does. A switch to Rx could give us this flexibility. I discuss this with Florian.

from sigma.

Ok, following plan: we switch to a Rx schema definition with alternatives.

from sigma.

Schema has updated to Rx schema with possibilities for strings and lists of strings mentioned above.

from sigma.