Multiple Updates - Migration to v2 Specification - First Batch

[frack113]

for V1.0.0 #11

• Remove old sigmac validator
• Fix multiple typos
• Rework Deprecated or Unsupported status field Validator
• Remove SigmahqInvalidFieldSourceValidator
• Fix SigmahqFalsepositivesTypoWordValidator and SigmahqFalsepositivesBannedWordValidator validators

Add:

• SigmahqSysmonMissingEventidIssue
• SigmahqUnknownFieldValidator

[nasbench]

Still a work in progress for some validators. Will look at them tomorrow.

In the meantime can you tell me why the SigmahqFalsepositivesBannedWordValidator and SigmahqFalsepositivesTypoWordValidatorlooks only at the first word?

• the SigmahqFalsepositivesTypoWordValidator should be applied to the whole string split
• the SigmahqFalsepositivesBannedWordValidator should be applied only to single word FPs

I can fix them, but i'm just double checking in case i'm missing something.

Also what is the case for SigmahqInvalidFieldSourceValidator validator?

[frack113]

SigmahqFalsepositivesBannedWordIssue : https://github.com/SigmaHQ/sigma/blob/8ff9cd8d20ffa6f653fa56ccd6c6b655c88506e0/tests/test_rules.py#L427
I guess, I thought the word would always be the first. 👴🏻

SigmahqInvalidFieldSourceValidator : https://github.com/SigmaHQ/sigma/blob/8ff9cd8d20ffa6f653fa56ccd6c6b655c88506e0/tests/test_rules.py#L298

I have try to make 1=1 with test_rules.py for the version "v0.x" .
Some test may be remove, like sigmac one, now.

[nasbench]

I will remove the SigmahqInvalidFieldSourceValidator (i think we don't need it anymore) test and rework the banned fp keyword