From 5cbd4d5e848967ac54d2850ba9c3206aa120ae2e Mon Sep 17 00:00:00 2001 From: FlorianBracq Date: Mon, 6 Apr 2026 15:20:17 +0200 Subject: [PATCH 1/5] Remove call of ExceptionOnUsage --- sigma/conversion/base.py | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/sigma/conversion/base.py b/sigma/conversion/base.py index 1584831b..bfb8853e 100644 --- a/sigma/conversion/base.py +++ b/sigma/conversion/base.py @@ -34,7 +34,6 @@ SigmaRuleReference, ) from sigma.exceptions import ( - ExceptionOnUsage, SigmaBackendError, SigmaConversionError, SigmaError, @@ -2644,10 +2643,8 @@ def convert_referenced_rules( self.referenced_rules_expression is None or self.referenced_rules_expression_joiner is None ): - return ExceptionOnUsage( # type: ignore - SigmaBackendError( - "Backend doesn't defines referenced rule expression but uses it in correlation query template" - ) + raise SigmaBackendError( + "Backend doesn't defines referenced rule expression but uses it in correlation query template" ) else: return self.referenced_rules_expression_joiner[method].join( From ce0542cc62a1bc5a23bffec8e6812512a1b43a45 Mon Sep 17 00:00:00 2001 From: FlorianBracq Date: Mon, 6 Apr 2026 15:21:30 +0200 Subject: [PATCH 2/5] raise deprecation warning when calling ExceptionOnUsage --- sigma/exceptions.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/sigma/exceptions.py b/sigma/exceptions.py index 49463f0b..abaea60d 100644 --- a/sigma/exceptions.py +++ b/sigma/exceptions.py @@ -1,6 +1,7 @@ +import warnings from dataclasses import dataclass from pathlib import Path -from typing import Any, Optional, TYPE_CHECKING +from typing import TYPE_CHECKING, Any, Optional if TYPE_CHECKING: from sigma.rule import SigmaRuleBase @@ -395,4 +396,8 @@ class ExceptionOnUsage: exception: Exception def __getattribute__(self, item: str) -> Any: + deprecation_message: str = ( + f"{type(self).__name__} is deprecated and will be removed in a future release." + ) + warnings.warn(deprecation_message, DeprecationWarning) raise object.__getattribute__(self, "exception") From f0c7384262a13ab313374735ce4acd29d9b88662 Mon Sep 17 00:00:00 2001 From: FlorianBracq Date: Mon, 6 Apr 2026 16:15:36 +0200 Subject: [PATCH 3/5] Add test to validate deprecation warning being raised --- tests/test_exceptions.py | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/tests/test_exceptions.py b/tests/test_exceptions.py index e3fdac52..b68cb731 100644 --- a/tests/test_exceptions.py +++ b/tests/test_exceptions.py @@ -1,7 +1,9 @@ -from pathlib import Path import re +from pathlib import Path + import pytest -from sigma.exceptions import SigmaDetectionError, SigmaRuleLocation, SigmaError + +from sigma.exceptions import ExceptionOnUsage, SigmaDetectionError, SigmaError, SigmaRuleLocation @pytest.fixture @@ -67,3 +69,13 @@ def test_exception_unequalness_different_type(): def test_exception_unequalness_incompatible_type(): assert SigmaDetectionError("A") != ValueError("A") + + +def test_exception_on_usage() -> None: + test_exception_message: str = "some message" + test_exception: ValueError = ValueError(test_exception_message) + e: ExceptionOnUsage = ExceptionOnUsage(test_exception) + with pytest.deprecated_call( + match=r"\w+ is deprecated and will be removed in a future release." + ), pytest.raises(ValueError, match=test_exception_message): + e.test From e6b0fcc4f2ddda8f996810def40ebc9447b5213b Mon Sep 17 00:00:00 2001 From: FlorianBracq Date: Mon, 6 Apr 2026 19:21:28 +0200 Subject: [PATCH 4/5] Update test to capture exception --- tests/test_conversion_correlations.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/tests/test_conversion_correlations.py b/tests/test_conversion_correlations.py index dc1c1575..d67d1b1f 100644 --- a/tests/test_conversion_correlations.py +++ b/tests/test_conversion_correlations.py @@ -63,9 +63,11 @@ def test_generate_query_without_referenced_rules_expression( ): monkeypatch.setattr(test_backend, "referenced_rules_expression", None) monkeypatch.setattr(test_backend, "referenced_rules_expression_joiner", None) - assert test_backend.convert(event_count_correlation_rule) == ["""EventID=4625 -| aggregate window=5min count() as event_count by TargetUserName, TargetDomainName, mappedB -| where event_count >= 10"""] + with pytest.raises( + SigmaBackendError, + match="Backend doesn't define referenced rule expression but uses it in correlation query template", + ): + test_backend.convert(event_count_correlation_rule) def test_event_count_correlation_single_rule_with_fields( From 51a36e6dc6e51e12ca799452e593616a76ee5721 Mon Sep 17 00:00:00 2001 From: FlorianBracq Date: Mon, 6 Apr 2026 19:21:41 +0200 Subject: [PATCH 5/5] Fix typo --- sigma/conversion/base.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sigma/conversion/base.py b/sigma/conversion/base.py index bfb8853e..078c75e1 100644 --- a/sigma/conversion/base.py +++ b/sigma/conversion/base.py @@ -2644,7 +2644,7 @@ def convert_referenced_rules( or self.referenced_rules_expression_joiner is None ): raise SigmaBackendError( - "Backend doesn't defines referenced rule expression but uses it in correlation query template" + "Backend doesn't define referenced rule expression but uses it in correlation query template" ) else: return self.referenced_rules_expression_joiner[method].join(