grafana/pySigma-backend-loki

Use `fnmatch.translate` for converting wildcards (globs) to regex

mostafa opened this issue · 2 comments

The fnmatch.translate is part of the standard library and can convert Unix shell-style wildcards into regular expressions. It might create more complex expressions.

"(?i)" + re.escape(str(value)).replace("\\?", ".").replace("\\*", ".*")

That's a really nice idea - I had no idea that fnmatch existed. However, it does include translating special characters that are not special characters in Sigma rules (the [seq] and [!seq] functionality). So, if we wanted to use that function, we'd need to first wrap any square brackets in the value with more square brackets - which feels to me like it might be introducing more complexity?

That's why I mentioned the complexity.