Attributed metadata history

v2.0.0

pySigma 2.0 Introduction Breaking Changes: SigmaPolicy as Central Security Control Point pySigma 2.0 introduces SigmaPolicy — a unified security configuration framework that replaces scattered method parameters across the codebase. This is a breaking change but brings significant security and usability improvements. What Changed: Security-related settings (allow_template_vars, allow_external_sources, vars_allowed_paths, regex_engine) are no longer individual method parameters All security settings now flow through the centralized SigmaPolicy dataclass Pipeline loading methods (ProcessingPipeline.from_yaml(), from_dict()) now accept a policy parameter instead of individual flags YAML and dictionary keys for security settings are explicitly stripped before instantiation — this prevents runtime opt-ins through untrusted pipeline definitions Why This Matters: pySigma operates in two fundamentally different trust models: Private CI/CD pipelines: You control both rules and conversions — enable powerful features like template vars and external sources Public web applications: Users upload rules — features that could be exploited are disabled by default SigmaPolicy declares your trust model once, and those settings propagate through the entire pipeline automatically. Predefined profiles available: SafePolicy — RE2 engine, all security features disabled TrustedPolicy — Python engine, for fully trusted rule sources Check out the documentation for further details. Hardened Defaults: DoS-Safe Regex Engine Default regex engine is now RE2RegexEngine (backed by Google RE2): ✅ Prevents catastrophic backtracking — no exponential time complexity from regex patterns ✅ Eliminates ReDoS vulnerabilities from untrusted Sigma rules ⚠️ Trade-off: RE2 doesn't support all advanced regex features that Python's re module does If you need full regex compatibility, explicitly use PythonRegexEngine: from sigma.policy import SigmaPolicy from sigma.policy.regex_engine import PythonRegexEngine policy = SigmaPolicy(regex_engine=PythonRegexEngine()) # Use with trusted rules only Breaking API Changes Method signatures have been updated across the codebase: Before (v1.5.1): pipeline = ProcessingPipeline.from_yaml( yaml_string, allow_template_vars=True, allow_external_sources=False, vars_allowed_paths=["/trusted/dir"] ) After (v2.0.0): from sigma.policy import SigmaPolicy policy = SigmaPolicy( allow_template_vars=True, allow_external_sources=False, vars_allowed_paths=("/trusted/dir",) ) pipeline = ProcessingPipeline.from_yaml(yaml_string, policy=policy) Security Hardening Details Top-level pipeline validation is strict: Unknown keys (including security settings) in YAML are rejected rather than silently passed through Nested transformation sanitization: Security-related keys in transformation YAML are explicitly stripped before instantiation Environment variable fallback: Legacy PYSIGMA_ALLOW_VARS_EXECUTION and PYSIGMA_ALLOW_EXTERNAL_SOURCES environment variables are respected as final fallback Template sandboxing: Methods of arbitrary objects in templates are blocked; only safe built-in types (str, int, dict, list, etc.) can have methods called Migration Guide If upgrading from v1.5.1: Audit security settings in your pipeline definitions Replace method parameters with SigmaPolicy instances Explicit opt-in required for previously-enabled features (they now default to disabled) Update YAML pipelines — ensure security settings are passed as policy parameter, not as top-level keys Test thoroughly — the defaults are more restrictive for security What's Changed fix: correctly handle escaped backslash before placeholder in expand modifier by @thomaspatzke with @Copilot in #553 Order rules topologically when resolving references by @cpoder in #552 [high] Stop @pipeline from aliasing every decorated pipeline to one singleton by @elhoim in #559 [high] Fix utf16 BOM bytes so utf16|base64/base64offset rules

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.