Sigma Go

https://pkg.go.dev/github.com/bradleyjkemp/sigma-go@latest
Admin
A Go implementation and parser of Sigma rules for building custom detection pipelines and alert...
Tokens:4,988
Snippets:73
Trust Score:9.6
Update:5 months ago
Show doc for...
Tokens:
Raw
### Get Condition position in input

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Returns the line and column number of a Condition within the original input string. Added in v0.6.2.

```go
func (c Condition) Position() (int, int)
```

--------------------------------

### Get FieldMatcher position in input

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Returns the line and column number of a FieldMatcher within the original input string. Added in v0.6.2.

```go
func (f FieldMatcher) Position() (int, int)
```

--------------------------------

### Parse and Match Sigma Rules in Go

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Demonstrates the basic usage of sigma-go to parse a Sigma rule and check if an event matches it. Ensure rules are loaded dynamically or via `sigmac`, and wrap them in an evaluator, providing necessary aggregation functions if used.

```go
var rule, _ = sigma.ParseRule(contents)

// Rules need to be wrapped in an evaluator.
// This is also where (if needed) you provide functions implementing the count, max, etc. aggregation functions
e := sigma.Evaluator(rule, options...)

// Get a stream of events from somewhere e.g. audit logs
for event := range events {
    if e.Matches(ctx, event) {
        // Raise your alert here
        newAlert(rule.ID, rule.Description, ...)
    }
}

```

--------------------------------

### Provide Custom Aggregation Functions for Sigma Rules

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Shows how to supply custom implementations for aggregation functions like count, max, or min when creating a sigma rule evaluator. This is necessary if your Sigma rules utilize these functions in their conditions.

```go
sigma.Evaluator(rule, sigma.CountFunc(countImplementation), sigma.MaxFunc(maxImplementation))
```

--------------------------------

### Define Logsource struct in sigma-go

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a log source with category, product, service, definition, and any additional fields.

```go
type Logsource struct {
	Category   string `yaml:",omitempty" json:",omitempty"
	Product    string `yaml:",omitempty" json:",omitempty"
	Service    string `yaml:",omitempty" json:",omitempty"
	Definition string `yaml:",omitempty" json:",omitempty"

	// Any non-standard fields will end up in here
	AdditionalFields map[string]interface{} `yaml:",inline,omitempty" json:",inline,omitempty"
}
```

--------------------------------

### Define FileType string type and constants

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Defines the FileType as a string and provides constants for different file types such as Unknown, Invalid, Rule, and Config. Added in v0.2.4.

```go
type FileType string
```

```go
const (
	UnknownFile FileType = ""
	InvalidFile FileType = "invalid"
	RuleFile    FileType = "rule"
	ConfigFile  FileType = "config"
)
```

--------------------------------

### Search.MarshalYAML Method

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Marshals a Search struct into YAML format.

```APIDOC
## Search.MarshalYAML Method

### Description
Marshals the `Search` struct into YAML format.

### Signature
```go
func (s Search) MarshalYAML() (interface{}, error)
```

### Returns
- **interface{}** - The YAML representation of the search.
- **error** - An error if marshaling fails.
```

--------------------------------

### Define Config struct in sigma-go

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents the configuration for Sigma rules, including title, order, backend compatibility, field mappings, logsources, default index, and placeholders. Added in v0.1.0.

```go
type Config struct {
	Title         string   // A short description of what this configuration does
	Order         int      // Defines the order of expansion when multiple config files are applicable
	Backends      []string // Lists the Sigma implementations that this config file is compatible with
	FieldMappings map[string]FieldMapping
	Logsources    map[string]LogsourceMapping
	// TODO: LogsourceMerging option
	DefaultIndex string                   // Defines a default index if no logsources match
	Placeholders map[string][]interface{} // Defines values for placeholders that might appear in Sigma rules
}
```

--------------------------------

### Define ComparisonOp type and constants in sigma-go

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Defines the ComparisonOp type as a string and provides constants for common comparison operators used in Sigma rules.

```go
type ComparisonOp string
```

```go
var (
	Equal            ComparisonOp = "="
	NotEqual         ComparisonOp = "!="
	LessThan         ComparisonOp = "<"
	LessThanEqual    ComparisonOp = "<="
	GreaterThan      ComparisonOp = ">"
	GreaterThanEqual ComparisonOp = ">="
)
```

--------------------------------

### Min Struct

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a minimum aggregation.

```APIDOC
## Min Struct

### Description
Represents a minimum aggregation operation.

### Fields
- **Field** (string) - The field to calculate the minimum value from.
- **GroupedBy** (string) - The field to group the results by.
```

--------------------------------

### Search Struct

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a search query with keywords and event matchers.

```APIDOC
## Search Struct

### Description
Represents a search query used in Sigma rules.

### Fields
- **Keywords** ([]string, optional) - A list of keywords for the search.
- **EventMatchers** ([]EventMatcher, optional) - A list of event matchers for the search.
```

--------------------------------

### LogsourceMapping Struct

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Defines a mapping for a logsource, including index and conditions.

```APIDOC
## LogsourceMapping Struct

### Description
Maps a logsource to specific indices and conditions.

### Fields
- **Logsource** (Logsource) - The logsource field.
- **Index** (LogsourceIndexes) - The index(es) to be used for this logsource.
- **Conditions** (Search) - Conditions added to all rules targeting this logsource.
- **Rewrite** (Logsource) - Rewrites this logsource to match another configuration.
```

--------------------------------

### Parse Sigma configuration file

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Parses the contents of a Sigma configuration file into a Config struct. Added in v0.1.0.

```go
func ParseConfig(contents []byte) (Config, error)
```

--------------------------------

### Marshal EventMatcher to YAML

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Custom marshaling for the EventMatcher type to YAML format. Added in v0.6.0.

```go
func (f EventMatcher) MarshalYAML() (interface{}, error)
```

--------------------------------

### Define LogsourceIndexes type as a slice of strings

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a list of log source indexes, defined as a slice of strings. Added in v0.1.0.

```go
type LogsourceIndexes []string
```

--------------------------------

### Search MarshalYAML Method Signature

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Method signature for marshaling a Search struct into YAML. Added in v0.6.0.

```go
func (s Search) MarshalYAML() (interface{}, error)
```

--------------------------------

### LogsourceMapping Type Definition

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Defines the structure for mapping log sources, including index and condition information. Added in v0.1.0.

```go
type LogsourceMapping struct {
	Logsource  `yaml:",inline"` // Matches the logsource field in Sigma rules
	Index      LogsourceIndexes // The index(es) that should be used
	Conditions Search           // Conditions that are added to all rules targeting this logsource
	Rewrite    Logsource        // Rewrites this logsource (i.e. so that it can be matched by another lower precedence config)
}
```

--------------------------------

### Search UnmarshalYAML Method Signature

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Method signature for unmarshaling YAML into a Search struct.

```go
func (s *Search) UnmarshalYAML(node *yaml.Node) error
```

--------------------------------

### Rule Type Definition

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a complete Sigma rule, including required and optional fields for title, logsource, detection, and metadata.

```go
type Rule struct {
	// Required fields
	Title     string
	Logsource Logsource
	Detection Detection

	ID          string        `yaml:",omitempty" json:",omitempty"`
	Related     []RelatedRule `yaml:",omitempty" json:",omitempty"`
	Status      string        `yaml:",omitempty" json:",omitempty"`
	Description string        `yaml:",omitempty" json:",omitempty"`
	Author      string        `yaml:",omitempty" json:",omitempty"`
	Level       string        `yaml:",omitempty" json:",omitempty"`
	References  []string      `yaml:",omitempty" json:",omitempty"`
	Tags        []string      `yaml:",omitempty" json:",omitempty"`

	// Any non-standard fields will end up in here
	AdditionalFields map[string]interface{} `yaml:",inline,omitempty" json:",inline,omitempty"`
}
```

--------------------------------

### Define Detection struct in sigma-go

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a Sigma detection rule, including searches, conditions, and an optional timeframe.

```go
type Detection struct {
	Searches   map[string]Search `yaml:"inline" json:",inline"
	Conditions Conditions        `yaml:"condition" json:"condition"
	Timeframe  time.Duration     `yaml:",omitempty" json:",omitempty"
}
```

--------------------------------

### Or Struct

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a logical OR operation between search expressions.

```APIDOC
## Or Struct

### Description
Represents a logical OR operation between multiple search expressions.

### Fields
- (implicit slice of SearchExpr) - The search expressions to be ORed together.
```

--------------------------------

### Search Position Method Signature

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Method signature for retrieving the line and column position of a Search struct in the original input. Added in v0.6.2.

```go
func (s Search) Position() (int, int)
```

--------------------------------

### Infer file type from contents

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Infers the FileType based on the provided byte contents. Added in v0.2.4.

```go
func InferFileType(contents []byte) FileType
```

--------------------------------

### Search.Position Method

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Returns the line and column of a Search struct in the original input.

```APIDOC
## Search.Position Method

### Description
Returns the line and column number of the `Search` struct within the original input data.

### Signature
```go
func (s Search) Position() (int, int)
```

### Returns
- **int** - The line number.
- **int** - The column number.
```

--------------------------------

### ParseRule Function

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

The `ParseRule` function takes a byte slice as input and returns a `Rule` struct and an error if parsing fails.

```APIDOC
## ParseRule Function

### Description
Parses a byte slice into a `Rule` struct.

### Signature
```go
func ParseRule(input []byte) (Rule, error)
```

### Parameters
- **input** ([]byte) - The byte slice containing the Sigma rule content.

### Returns
- **Rule** - The parsed Sigma rule.
- **error** - An error if the parsing process fails.
```

--------------------------------

### ParseRule Function Signature

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Function signature for parsing a Sigma rule from a byte slice. Returns the parsed Rule and an error if parsing fails.

```go
func ParseRule(input []byte) (Rule, error)
```

--------------------------------

### ParseConfig

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Parses a byte slice containing configuration data into a Config struct.

```APIDOC
## ParseConfig

### Description
Parses configuration data from a byte slice.

### Function Signature
`func ParseConfig(contents []byte) (Config, error)`

### Parameters
* **contents** ([]byte) - The byte slice containing the configuration data.

### Returns
* **Config** - The parsed Config struct.
* **error** - An error if parsing fails.
```

--------------------------------

### Unmarshal Detection from YAML

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Custom unmarshaling for the Detection type from YAML format. Added in v0.6.2.

```go
func (d *Detection) UnmarshalYAML(node *yaml.Node) error
```

--------------------------------

### Search Type Definition

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a search query, composed of keywords and event matchers.

```go
type Search struct {
	Keywords      []string       `yaml:",omitempty" json:",omitempty"`
	EventMatchers []EventMatcher `yaml:",omitempty" json:",omitempty"`
	// contains filtered or unexported fields
}
```

--------------------------------

### Rule Struct

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a Sigma rule, including metadata and detection logic.

```APIDOC
## Rule Struct

### Description
Represents a Sigma rule with its various fields.

### Fields
- **Title** (string) - The title of the rule.
- **Logsource** (Logsource) - The logsource information for the rule.
- **Detection** (Detection) - The detection logic of the rule.
- **ID** (string, optional) - The unique identifier of the rule.
- **Related** ([]RelatedRule, optional) - A list of related rules.
- **Status** (string, optional) - The status of the rule (e.g., stable, experimental).
- **Description** (string, optional) - A detailed description of the rule.
- **Author** (string, optional) - The author of the rule.
- **Level** (string, optional) - The severity level of the rule.
- **References** ([]string, optional) - A list of references for the rule.
- **Tags** ([]string, optional) - A list of tags associated with the rule.
- **AdditionalFields** (map[string]interface{}, optional) - Any non-standard fields found in the rule.
```

--------------------------------

### OneOfPattern Struct

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a choice between multiple string patterns.

```APIDOC
## OneOfPattern Struct

### Description
Represents a condition where the field must match one of the provided patterns.

### Fields
- **Pattern** (string) - The pattern to match.
```

--------------------------------

### Min Struct Definition

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a minimum value aggregation, specifying the field and grouping criteria.

```go
type Min struct {
	Field     string
	GroupedBy string
}
```

--------------------------------

### Search.UnmarshalYAML Method

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Unmarshals YAML data into a Search struct.

```APIDOC
## Search.UnmarshalYAML Method

### Description
Unmarshals YAML data from a `yaml.Node` into the `Search` struct.

### Signature
```go
func (s *Search) UnmarshalYAML(node *yaml.Node) error
```

### Parameters
- **node** (*yaml.Node) - The YAML node to unmarshal.

### Returns
- **error** - An error if unmarshaling fails.
```

--------------------------------

### Or Type Definition

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a logical OR operation on a slice of search expressions.

```go
type Or []SearchExpr
```

--------------------------------

### Not Struct

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a negation of a search expression.

```APIDOC
## Not Struct

### Description
Represents the logical negation of a search expression.

### Fields
- **Expr** (SearchExpr) - The search expression to negate.
```

--------------------------------

### Parse Sigma condition syntax

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Parses a given string input into a Condition struct. This function is used to interpret Sigma condition syntax.

```go
func ParseCondition(input string) (Condition, error)
```

--------------------------------

### OneOfPattern Struct Definition

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a pattern that can match one of several options.

```go
type OneOfPattern struct {
	Pattern string
}
```

--------------------------------

### Sum Struct

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a sum aggregation.

```APIDOC
## Sum Struct

### Description
Represents a sum aggregation operation.

### Fields
- **Field** (string) - The field to sum.
- **GroupedBy** (string) - The field to group the results by.
```

--------------------------------

### SearchExpr Interface

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

An interface representing a search expression in Sigma rules.

```APIDOC
## SearchExpr Interface

### Description
Represents a generic search expression within Sigma rules. This interface is used to define various types of search conditions.
```

--------------------------------

### OneOfThem Struct

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a condition where any of the items in a list are matched.

```APIDOC
## OneOfThem Struct

### Description
Represents a condition that matches if any of the items in a list are present. This is often used with fields that can contain multiple values.
```

--------------------------------

### Unmarshal EventMatcher from YAML

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Custom unmarshaling for the EventMatcher type from YAML format. Added in v0.4.0.

```go
func (f *EventMatcher) UnmarshalYAML(node *yaml.Node) error
```

--------------------------------

### OneOfThem Struct Definition

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

An empty struct, likely used as a placeholder or for specific type-checking.

```go
type OneOfThem struct{}
```

--------------------------------

### Marshal Condition to YAML

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Custom marshaling for the Condition type to YAML format. Added in v0.6.0.

```go
func (c Condition) MarshalYAML() (interface{}, error)
```

--------------------------------

### Max Struct

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a maximum aggregation.

```APIDOC
## Max Struct

### Description
Represents a maximum aggregation operation.

### Fields
- **Field** (string) - The field to calculate the maximum value from.
- **GroupedBy** (string) - The field to group the results by.
```

--------------------------------

### SearchIdentifier Struct Definition

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents an identifier used in search expressions.

```go
type SearchIdentifier struct {
	Name string
}
```

--------------------------------

### OneOfIdentifier Struct Definition

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a search identifier that can be one of several options.

```go
type OneOfIdentifier struct {
	Ident SearchIdentifier
}
```

--------------------------------

### InferFileType

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Infers the file type (rule, config, etc.) from a byte slice of file contents.

```APIDOC
## InferFileType

### Description
Infers the type of the Sigma file based on its content.

### Function Signature
`func InferFileType(contents []byte) FileType`

### Parameters
* **contents** ([]byte) - The byte slice containing the file content.

### Returns
* **FileType** - The inferred file type (e.g., RuleFile, ConfigFile, UnknownFile).
```

--------------------------------

### Define FieldMapping struct in sigma-go

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a mapping for a field, specifying the target names that appear in the events being matched. Added in v0.1.0.

```go
type FieldMapping struct {
	TargetNames []string // The name(s) that appear in the events being matched

}
```

--------------------------------

### Unmarshal FileType from YAML

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Custom unmarshaling for the FileType type from YAML format. Added in v0.2.4.

```go
func (f *FileType) UnmarshalYAML(node *yaml.Node) error
```

--------------------------------

### Marshal Conditions to YAML

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Custom marshaling for the Conditions type to YAML format. Added in v0.6.0. This function allows marshaling conditions back to grammar expressions.

```go
func (c Conditions) MarshalYAML() (interface{}, error)
```

--------------------------------

### OneOfIdentifier Struct

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a choice between multiple identifiers.

```APIDOC
## OneOfIdentifier Struct

### Description
Represents a condition where one of the specified identifiers must match.

### Fields
- **Ident** (SearchIdentifier) - The identifier to match.
```

--------------------------------

### SearchExpr Interface Definition

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Interface representing a generic search expression, with no exported methods.

```go
type SearchExpr interface {
	// contains filtered or unexported methods
}
```

--------------------------------

### Max Struct Definition

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a maximum value aggregation, specifying the field and grouping criteria.

```go
type Max struct {
	Field     string
	GroupedBy string
}
```

--------------------------------

### Not Struct Definition

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a logical NOT operation on a search expression.

```go
type Not struct {
	Expr SearchExpr
}
```

--------------------------------

### Sum Struct Definition

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a sum aggregation, specifying the field and grouping criteria.

```go
type Sum struct {
	Field     string
	GroupedBy string
}
```

--------------------------------

### Define FieldMatcher struct in sigma-go

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a matcher for a specific field, including modifiers and values to match against.

```go
type FieldMatcher struct {
	Field     string        `yaml:",omitempty" json:",omitempty"
	Modifiers []string      `yaml:",omitempty" json:",omitempty"
	Values    []interface{} `yaml:",omitempty" json:",omitempty"
	// contains filtered or unexported fields
}
```

--------------------------------

### Near Struct

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a 'near' condition in search expressions.

```APIDOC
## Near Struct

### Description
Represents a 'near' condition, typically used for proximity searches.

### Fields
- **Condition** (SearchExpr) - The search expression that defines the proximity condition.
```

--------------------------------

### SearchIdentifier Struct

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents an identifier within a search expression.

```APIDOC
## SearchIdentifier Struct

### Description
Represents a named identifier within a Sigma search expression.

### Fields
- **Name** (string) - The name of the identifier.
```

--------------------------------

### Define Comparison struct in sigma-go

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Defines the structure for a comparison operation within Sigma rules, including the aggregation function, operator, and threshold.

```go
type Comparison struct {
	Func      AggregationFunc
	Op        ComparisonOp
	Threshold float64
}
```

--------------------------------

### Unmarshal FieldMapping from YAML

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Custom unmarshaling for the FieldMapping type from YAML format. Added in v0.1.0.

```go
func (f *FieldMapping) UnmarshalYAML(value *yaml.Node) error
```

--------------------------------

### Near Struct Definition

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Defines a 'near' condition for search expressions. Added in v0.1.0.

```go
type Near struct {
	Condition SearchExpr
}
```

--------------------------------

### ParseCondition

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Parses a given string into a Condition struct, representing a Sigma condition syntax.

```APIDOC
## ParseCondition

### Description
Parses the Sigma condition syntax from an input string.

### Function Signature
`func ParseCondition(input string) (Condition, error)`

### Parameters
* **input** (string) - The Sigma condition syntax string to parse.

### Returns
* **Condition** - The parsed Condition struct.
* **error** - An error if parsing fails.
```

--------------------------------

### RelatedRule Struct

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a relationship to another Sigma rule.

```APIDOC
## RelatedRule Struct

### Description
Defines a link to another related Sigma rule.

### Fields
- **ID** (string) - The ID of the related rule.
- **Type** (string) - The type of relationship (e.g., 'includes', 'derived').
```

--------------------------------

### Unmarshal LogsourceIndexes from YAML

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Custom unmarshaling for the LogsourceIndexes type from YAML format. Added in v0.1.0.

```go
func (i *LogsourceIndexes) UnmarshalYAML(value *yaml.Node) error
```

--------------------------------

### Define Condition struct in sigma-go

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a condition in a Sigma rule, which can be either a search expression or an aggregation expression.

```go
type Condition struct {
	Search      SearchExpr      `yaml:",omitempty" json:",omitempty"
	Aggregation AggregationExpr `yaml:",omitempty" json:",omitempty"
	// contains filtered or unexported fields
}
```

--------------------------------

### Define Conditions type as a slice of Condition

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Defines Conditions as a slice of Condition structs, representing multiple conditions within a Sigma rule.

```go
type Conditions []Condition
```

--------------------------------

### Define Count struct in sigma-go

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a count aggregation, specifying the field to count and an optional field to group by.

```go
type Count struct {
	Field     string
	GroupedBy string
}
```

--------------------------------

### Unmarshal Conditions from YAML

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Custom unmarshaling for the Conditions type from YAML format. This function is used to parse YAML nodes into Conditions.

```go
func (c *Conditions) UnmarshalYAML(node *yaml.Node) error
```

--------------------------------

### Define EventMatcher type as a slice of FieldMatcher

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Represents a collection of field matchers for events, defined as a slice of FieldMatcher structs. Added in v0.4.0.

```go
type EventMatcher []FieldMatcher
```

--------------------------------

### RelatedRule Struct Definition

Source: https://pkg.go.dev/github.com/bradleyjkemp/sigma-go

Defines a relationship to another Sigma rule, including its ID and type. Added in v0.5.0.

```go
type RelatedRule struct {
	ID   string
	Type string
}
```
Tokens:
Raw