Deprecate ExceptionOnUsage

sigma/conversion/base.py

@@ -34,7 +34,6 @@
     SigmaRuleReference,
 )
 from sigma.exceptions import (
-    ExceptionOnUsage,
     SigmaBackendError,
     SigmaConversionError,
     SigmaError,
@@ -2644,10 +2643,8 @@ def convert_referenced_rules(
             self.referenced_rules_expression is None
             or self.referenced_rules_expression_joiner is None
         ):
-            return ExceptionOnUsage(  # type: ignore
-                SigmaBackendError(
-                    "Backend doesn't defines referenced rule expression but uses it in correlation query template"
-                )
+            raise SigmaBackendError(
+                "Backend doesn't define referenced rule expression but uses it in correlation query template"
             )
         else:
             return self.referenced_rules_expression_joiner[method].join(

sigma/exceptions.py

@@ -1,6 +1,7 @@
+import warnings
 from dataclasses import dataclass
 from pathlib import Path
-from typing import Any, Optional, TYPE_CHECKING
+from typing import TYPE_CHECKING, Any, Optional
 
 if TYPE_CHECKING:
     from sigma.rule import SigmaRuleBase
@@ -395,4 +396,8 @@ class ExceptionOnUsage:
     exception: Exception
 
     def __getattribute__(self, item: str) -> Any:
+        deprecation_message: str = (
+            f"{type(self).__name__} is deprecated and will be removed in a future release."
+        )
+        warnings.warn(deprecation_message, DeprecationWarning)
         raise object.__getattribute__(self, "exception")

tests/test_conversion_correlations.py

@@ -63,9 +63,11 @@ def test_generate_query_without_referenced_rules_expression(
 ):
     monkeypatch.setattr(test_backend, "referenced_rules_expression", None)
     monkeypatch.setattr(test_backend, "referenced_rules_expression_joiner", None)
-    assert test_backend.convert(event_count_correlation_rule) == ["""EventID=4625
-| aggregate window=5min count() as event_count by TargetUserName, TargetDomainName, mappedB
-| where event_count >= 10"""]
+    with pytest.raises(
+        SigmaBackendError,
+        match="Backend doesn't define referenced rule expression but uses it in correlation query template",
+    ):
+        test_backend.convert(event_count_correlation_rule)
 
 
 def test_event_count_correlation_single_rule_with_fields(

tests/test_exceptions.py

@@ -1,7 +1,9 @@
-from pathlib import Path
 import re
+from pathlib import Path
+
 import pytest
-from sigma.exceptions import SigmaDetectionError, SigmaRuleLocation, SigmaError
+
+from sigma.exceptions import ExceptionOnUsage, SigmaDetectionError, SigmaError, SigmaRuleLocation
 
 
 @pytest.fixture
@@ -67,3 +69,13 @@ def test_exception_unequalness_different_type():
 
 def test_exception_unequalness_incompatible_type():
     assert SigmaDetectionError("A") != ValueError("A")
+
+
+def test_exception_on_usage() -> None:
+    test_exception_message: str = "some message"
+    test_exception: ValueError = ValueError(test_exception_message)
+    e: ExceptionOnUsage = ExceptionOnUsage(test_exception)
+    with pytest.deprecated_call(
+        match=r"\w+ is deprecated and will be removed in a future release."
+    ), pytest.raises(ValueError, match=test_exception_message):
+        e.test