diff --git a/src/fylgja-cli.js b/src/fylgja-cli.js index 612665f..e5dde90 100644 --- a/src/fylgja-cli.js +++ b/src/fylgja-cli.js @@ -428,13 +428,13 @@ Fylgja CLI Help Basic Sigma Commands: - search sigma - Search for Sigma rules by keyword - details sigma - Get details about a specific Sigma rule -- sigma stats - Get statistics about Sigma rules database +- stats sigma - Get statistics about Sigma rules database Advanced Sigma Search Commands: -- search sigma rules where title contains "ransomware" - Search by title -- search sigma rules where tags include privilege_escalation - Search by tags -- search sigma rules where logsource.category == "process_creation" - Search by log source -- search sigma rules where modified after 2024-01-01 - Search by modification date +- search sigma where title contains "ransomware" - Search by title +- search sigma where tags include privilege_escalation - Search by tags +- search sigma where logsource.category == "process_creation" - Search by log source +- search sigma where modified after 2024-01-01 - Search by modification date - exit or quit - Exit the CLI diff --git a/src/handlers/sigma/sigma_details_handler.js b/src/handlers/sigma/sigma_details_handler.js index e3896e8..079db7d 100644 --- a/src/handlers/sigma/sigma_details_handler.js +++ b/src/handlers/sigma/sigma_details_handler.js @@ -8,7 +8,6 @@ const logger = require('../../utils/logger'); const { handleError } = require('../../utils/error_handler'); const { getSigmaRuleDetails, getSigmaRuleYaml } = require('../../services/sigma/sigma_details_service'); const { getSigmaRuleDetailsBlocks } = require('../../blocks/sigma/sigma_details_block'); -const { formatSigmaDetails } = require('../../utils/cli_formatters'); const { getFileName } = require('../../utils/file_utils'); const FILE_NAME = getFileName(__filename); @@ -77,8 +76,8 @@ const handleCommand = async (command, respond) => { // Return the response with both blocks for Slack and responseData for CLI await respond({ - blocks: blocks, // For Slack - responseData: sigmaRuleDetailsResult.explanation, // For CLI + blocks: blocks, // For Slack interface + responseData: sigmaRuleDetailsResult.explanation, // For CLI interface response_type: 'in_channel' }); } catch (error) { diff --git a/src/lang/command_patterns.js b/src/lang/command_patterns.js index bcd38f3..fccdc22 100644 --- a/src/lang/command_patterns.js +++ b/src/lang/command_patterns.js @@ -17,20 +17,12 @@ const commandPatterns = [ // Sigma details patterns { - name: 'sigma-details-direct', - regex: /^(explain|get|show|display|details|info|about)\s+(rule|detection)\s+(from\s+)?sigma\s+(where\s+)?(id=|id\s+is\s+|with\s+id\s+)(.+)$/i, - action: 'details', - module: 'sigma', - params: [6] // rule ID is in capturing group 6 - }, - { - name: 'sigma-details-simple', - regex: /^(details|explain)\s+(.+)$/i, + name: 'sigma-details', + regex: /^sigma\s+(details|info|about)\s+(.+)$/i, action: 'details', module: 'sigma', params: [2] // rule ID is in capturing group 2 }, - // Sigma search patterns { name: 'sigma-search',