diff --git a/sigma/conversion/base.py b/sigma/conversion/base.py index 1584831b..078c75e1 100644 --- a/sigma/conversion/base.py +++ b/sigma/conversion/base.py @@ -34,7 +34,6 @@ SigmaRuleReference, ) from sigma.exceptions import ( - ExceptionOnUsage, SigmaBackendError, SigmaConversionError, SigmaError, @@ -2644,10 +2643,8 @@ def convert_referenced_rules( self.referenced_rules_expression is None or self.referenced_rules_expression_joiner is None ): - return ExceptionOnUsage( # type: ignore - SigmaBackendError( - "Backend doesn't defines referenced rule expression but uses it in correlation query template" - ) + raise SigmaBackendError( + "Backend doesn't define referenced rule expression but uses it in correlation query template" ) else: return self.referenced_rules_expression_joiner[method].join( diff --git a/sigma/exceptions.py b/sigma/exceptions.py index 49463f0b..abaea60d 100644 --- a/sigma/exceptions.py +++ b/sigma/exceptions.py @@ -1,6 +1,7 @@ +import warnings from dataclasses import dataclass from pathlib import Path -from typing import Any, Optional, TYPE_CHECKING +from typing import TYPE_CHECKING, Any, Optional if TYPE_CHECKING: from sigma.rule import SigmaRuleBase @@ -395,4 +396,8 @@ class ExceptionOnUsage: exception: Exception def __getattribute__(self, item: str) -> Any: + deprecation_message: str = ( + f"{type(self).__name__} is deprecated and will be removed in a future release." + ) + warnings.warn(deprecation_message, DeprecationWarning) raise object.__getattribute__(self, "exception") diff --git a/tests/test_conversion_correlations.py b/tests/test_conversion_correlations.py index dc1c1575..d67d1b1f 100644 --- a/tests/test_conversion_correlations.py +++ b/tests/test_conversion_correlations.py @@ -63,9 +63,11 @@ def test_generate_query_without_referenced_rules_expression( ): monkeypatch.setattr(test_backend, "referenced_rules_expression", None) monkeypatch.setattr(test_backend, "referenced_rules_expression_joiner", None) - assert test_backend.convert(event_count_correlation_rule) == ["""EventID=4625 -| aggregate window=5min count() as event_count by TargetUserName, TargetDomainName, mappedB -| where event_count >= 10"""] + with pytest.raises( + SigmaBackendError, + match="Backend doesn't define referenced rule expression but uses it in correlation query template", + ): + test_backend.convert(event_count_correlation_rule) def test_event_count_correlation_single_rule_with_fields( diff --git a/tests/test_exceptions.py b/tests/test_exceptions.py index e3fdac52..b68cb731 100644 --- a/tests/test_exceptions.py +++ b/tests/test_exceptions.py @@ -1,7 +1,9 @@ -from pathlib import Path import re +from pathlib import Path + import pytest -from sigma.exceptions import SigmaDetectionError, SigmaRuleLocation, SigmaError + +from sigma.exceptions import ExceptionOnUsage, SigmaDetectionError, SigmaError, SigmaRuleLocation @pytest.fixture @@ -67,3 +69,13 @@ def test_exception_unequalness_different_type(): def test_exception_unequalness_incompatible_type(): assert SigmaDetectionError("A") != ValueError("A") + + +def test_exception_on_usage() -> None: + test_exception_message: str = "some message" + test_exception: ValueError = ValueError(test_exception_message) + e: ExceptionOnUsage = ExceptionOnUsage(test_exception) + with pytest.deprecated_call( + match=r"\w+ is deprecated and will be removed in a future release." + ), pytest.raises(ValueError, match=test_exception_message): + e.test