Add new query language plugin #2074
Conversation
This commit adds a new query language plugin that allows for specifying "frontend" languages. We rewrote the Sigma rule parser as an example plugin to demonstrate the use.
|
@dominiklohmann I need a review from you at some point to figure out if I added the plugin to CI properly, or whether it should be part of the matrix like the examples. |
|
I'd prefer for it to be part of the matrix, that's quicker to build. The only reason why the PCAP plugin isn't added that way is because we use it for testing bundled plugin builds. |
Okay, changed. Do I need to do anything to invoke the unit and integration tests from CI? Or is this handled by the plugin framework? |
|
@dominiklohmann any idea why the PR checks do not include the plugin, even though I changed |
Should be handled automatically.
It's not made required yet in the branch protections, so it'll only show up once it's actually running. It is now. |
mavam
force-pushed
the
topic/query-language-plugin
branch
from
f41d76c to
0fab1f3
Compare
mavam
force-pushed
the
topic/query-language-plugin
branch
from
0fab1f3 to
b1f85dc
Compare
This PR adds a new query language plugin that allows for specifying a "frontend" language to VAST. The vision is that VAST can execute queries from multiple languages and uses a unified intermediate representation (such as substrait internally. The VAST language then becomes one frontend of many others.
As an example frontend, we use Sigma, for which VAST already has (syntactical) parser support.
📝 Checklist
Support configuration of query language frontends in(separate PR?)vast.yaml🎯 Review Instructions
File-by-file.