sigma-cli: exit code 0 can still be the wrong query

Success is “a query was emitted”

sigma convert exits 0 when the backend could print a query. It does not check that the printed fields are the ones your index uses for that meaning, and it does not run the query. A green CI step that only checks the exit code will merge a query that answers a different question than the YAML.

Read the query as text before anyone trusts a hit count from it. The count is an answer to whatever was printed, which may not be the detection.

Put the YAML field beside the query field

For each selection key, write the YAML field and modifier on the left and the field name inside the printed query on the right. Image|endswith is a statement about the process image. If the pipeline emits that test against the command-line field, the conversion succeeded and the query is still wrong: any command line that mentions the path will count.

Also check the log source. If the printed query has no index or source constraint, it will search every sourcetype that happens to contain the mapped field. Exit code 0 does not add that constraint for you.

Snippet

# rules/lab-agent.yml  (selection)
Image|endswith: '\lab-agent.exe'

$ sigma convert -t splunk -p pipelines/swapped.yml rules/lab-agent.yml
process_command_line="*\\lab-agent.exe"
$ echo $?
0

One event that must not match

Keep two lab lines with the rule. The positive line has the image path the YAML names. The negative line is a different program whose command line only mentions that path, for example a script that prints it. Run the printed query against both. If the negative line matches, do not ship the query, even though convert exited 0.

Fix the pipeline or the rule until the negative line is quiet and the positive line still hits. Store both lines next to the YAML so the next edit repeats the check.

Worked case: the path searched on the wrong field

The lab rule should count starts of lab-agent.exe. The swapped pipeline maps Image to process_command_line. Convert prints a query and exits 0. Over the lab day the query returns 40 events. Two of them are real starts. The other 38 are inventory scripts whose command line contains the path while the image is powershell.exe or cmd.exe.

The review note says the exit code was 0 and the query is still wrong, and it quotes the YAML field beside the printed field. After the mapping sends Image to the image field, the same day returns the two starts. The 40 is kept in the note as the count of the wrong query, not as the detection’s volume.

Diagram

Exit code versus the question the query asks

A printed query can be the wrong question.

Exit code 0

Means. The backend emitted text

Checks. That the rule converted

Does not check. That the field still means what the YAML said

A lined-up query

Means. Each YAML field landed on the intended indexed field

Checks. A positive lab line hits and a negative line does not

Does not check. Nothing about production volume

Check yourself

1. sigma convert exits 0. What has been shown?

2. Image|endswith is emitted against the command-line field. What is true?

3. Why keep a lab event that must not match?