Lint: warn when a rule declares no ATT&CK technique tag - #25
Merged
Conversation
A tactic tag alone does not say which technique a rule covers, and a rule with no technique cannot be placed on the matrix. Across the public SigmaHQ corpus 346 of 3,143 rules (11%) stop at the tactic; every declared technique there resolves, so this is the ATT&CK gap that actually exists. New table row "at least one attack.t* technique tag", severity warning, reported once and not double-counted with the resolve checks. Golden expectations updated; the fieldref fixture is a real tactic-only rule and now shows the warning. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
SonarCloud analysis · PR #25Quality gate: ✅ Passed · Open in SonarCloud
Open issues on new code: 0No open issues on the changed code. 🎉 Commit |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A 14th lint row, at least one
attack.t*technique tag, severity warning. A tactic tag alone does not say which technique the rule covers, and an untagged rule cannot be placed on the ATT&CK matrix.Why now
Scanning the public SigmaHQ corpus (3,143 rules) with the shipped linter: every declared technique ID resolves against v19.2 (0 unknown, 0 retired), but 346 rules (11%) carry a tactic and no technique. That is the ATT&CK gap that actually exists in the corpus, and it is larger in rulesets that arrive unmapped.
Details
lint.py: newCHECK_TABLErow before the resolve checks; the finding is emitted once from the mapped tags, so it never double-reports with unknown/retired findings (a rule with a bad technique ID still passes coverage and fails resolve).attack_coverage: passon six; the fieldref fixture is a real tactic-only corpus rule and now expects the warning.Backend 242 passed, frontend typecheck and vitest green.
🤖 Generated with Claude Code