File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -707,3 +707,38 @@ def test_value_median_correlation_single_rule_with_grouping(
707707| aggregate window=5min median(ResponseTime) as value_median by Endpoint
708708| where value_median >= 1000"""
709709 ]
710+
711+
712+ def test_value_percentile_correlation_missing_percentile (test_backend ):
713+ """Test that missing percentile attribute raises SigmaConversionError for value_percentile correlation"""
714+ correlation_rule = SigmaCollection .from_yaml (
715+ """
716+ title: Network traffic event
717+ name: network_traffic
718+ status: test
719+ logsource:
720+ product: network
721+ detection:
722+ selection:
723+ EventType: network_traffic
724+ condition: selection
725+ ---
726+ title: High percentile latency without percentile
727+ status: test
728+ correlation:
729+ type: value_percentile
730+ rules:
731+ - network_traffic
732+ group-by:
733+ - SourceIP
734+ timespan: 15m
735+ condition:
736+ gte: 500
737+ field: Latency
738+ """
739+ )
740+ with pytest .raises (
741+ SigmaConversionError ,
742+ match = "Percentile must be specified in condition for value_percentile correlation type"
743+ ):
744+ test_backend .convert (correlation_rule )
You can’t perform that action at this time.
0 commit comments