Skip to content

🪧 add JSON schema and spec for sigmaHQ regression data - #217

Open
frack113 wants to merge 5 commits into
SigmaHQ:v2.2.0from
frack113:feat/regression-data
Open

frack113 wants to merge 5 commits into
SigmaHQ:v2.2.0from
frack113:feat/regression-data

Conversation

@frack113

Copy link
Copy Markdown
Member

Summary

Add a JSON Schema for regression test info.yml files and a complete specification document.

Files Added

  • json-schema/sigmahq-regression-data-schema.json — JSON Schema for regression test metadata files
  • sigmahq/sigmahq-regression-data.md — Complete specification covering:
    • Directory structure
    • info.yml field requirements
    • Linking regression tests to Sigma rules
    • Test sample file naming convention
    • Test types (currently only Positive Detection Test)
    • Status requirements
    • Validation rules

Files Modified

  • specification/sigma-appendix-tags.md — Update MITRE attack URLs (wiki -> new domain)
  • specification/sigma-appendix-taxonomy.md — Formatting fix

Related

Closes #204

- type enum: add json, ndjson, jsonl
- name is no longer required
- add optional pipelines and filters fields
- add pipelines/ directory to the layout
- json, ndjson, jsonl are supported test types (replaces reserved raw/log)
- name is optional, provider is informational only
- document pipelines and filters fields
- .json sample is the test sample for JSON entries, not a debug companion
@nasbench
nasbench changed the base branch from main to v2.2.0 September 25, 2026 20:34

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant