Public/Set-SigmaException.ps1

<#
.SYNOPSIS
    sigmadb - Set Sigma Exception
.DESCRIPTION
    Changes existing exception for a sigma rule in the database
.EXAMPLE
    PS C:\> Set-SigmaException -Id '1' -Operator 'nand' -SearchId 'filter' -Filter '{"LogonType":9,"user.name":"user1"}' -Database .\test.db
    Changes existing exception for sigma rule '1' in Database .\test.db with the following YAML structure:
        filter:
            LogonType: 9
            user.name: 'user1'
        [...]
        condition: [...] and not filter
.INPUTS
    Id: Sigma rule ID
    Operator: Condition operator (and, nand, or, nor)
    SearchId: Desired search identifier for the sigma rule
    Filter: The content filter
    Database: Path to database file
.OUTPUTS
    None
.NOTES
    Author: ncrqnt
    Date: 08.09.2021
    PowerShell: 7.1.4
 
    Changelog:
    1.1.2 22.09.2021 ncrqnt Changed call of SigmaDB class
    1.1.1 16.09.2021 ncrqnt Restructure of config file
    1.1.0 13.09.2021 ncrqnt Changed Database parameter to Config
    1.0.2 08.09.2021 ncrqnt Added replacement for not-operators
    1.0.1 08.09.2021 ncrqnt Changed parameter order and made them all mandatory
    1.0.0 08.09.2021 ncrqnt Initial creation
#>


function Set-SigmaException {
    [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Low')]
    param (
        [Parameter(Mandatory = $true)]
        [string]$Id,
        [Parameter(Mandatory = $true)]
        [string]$SearchId,
        [Parameter(Mandatory = $false)]
        [ValidateSet('and', 'nand', 'or', 'nor')]
        [string]$Operator = 'nand',
        [Parameter(Mandatory = $true)]
        [ValidateScript({if (Test-Json $_) { $true } else { throw "'$_' is not a valid JSON format!"}})]
        [string]$Filter,
        [Parameter(Mandatory = $false)]
        [string]$Config = '.\sigmadb\config.yml'
    )

    begin {
        $cfg = Get-PrivSigmaConfig -Config $Config
        $db = New-Object -TypeName SigmaDB -ArgumentList $cfg.Files.Database
    }

    process {
        # replace 'not' operator abbrevation
        switch ($Operator) {
            'nand' { $op = 'and not' }
            'nor' { $op = 'or not'}
            default { $op = $Operator }
        }

        # check if rule exist
        $rule = $db.Query("SELECT * FROM rule WHERE id = @id", @{ id = $Id })

        if ($rule.Count -gt 0) {
            $exceptions = $db.Query("SELECT * FROM exception WHERE rule_id = @id", @{ id = $Id })

            if ($exceptions.Count -gt 0) {
                if ($SearchId -in $exceptions.search_identifier) {
                    $exception = $exceptions | Where-Object { $_.search_identifier -eq $SearchId }
                    if ($PSCmdlet.ShouldProcess($cfg.Files.Database, "Set-PrivSigmaException")) {
                        Set-PrivSigmaException -ExceptionId $exception.id -RuleId $Id -Operator $op -SearchId $SearchId -Filter $filter -Database $db
                    }
                }
                else {
                    Write-Warning "Search Identifier '$SearchId' not found for rule '$Id'. Use New-SigmaException instead."
                }

            }
            else {
                Write-Warning "No exceptions found for rule '$Id'. Use New-SigmaException instead."
            }
        }
        else {
            Write-Warning -Message "No rule with id '$Id' found."
        }
    }

    end {
        $db.Close()
    }
}