Как проверить yml файл на ошибки

Check out our primary project!
Browserling

We created Browserling – get a cloud browser in 5 seconds. Check it out!

Pro tips
Master online yaml tools

Coming soon
These yaml tools are on the way

Text Tools

String Utilities

Case Converter

Sort Lines

Diff Checker

Text Editor

JSON Editor

Lorem Ipsum Generator

URL Parser / Query String Splitter

Slug Generator

HTML Stripper

Pastebin

Formatters

HTML Formatter / Minifier

CSS Beautifier / Minifier

JavaScript Beautifier / Minifier

JSON Formatter / Minifier

XML Formatter / Minifier

SQL Formatter / Minifier

Escape and Unescape Tools

HTML Escape / Unescape

JavaScript Escape / Unescape

JSON Escape / Unescape

XML Escape / Unescape

SQL Escape / Unescape

Validators

HTML Validator

JSON Validator

YAML Validator

Credit Card Validator

Regular Expression Tester

Cryptography and Security

Hash Generator

HMAC Generator

Checksum Calculator

Password Generator

Bcrypt Generator / Checker

UUID Generator

Encoders and Decoders

URL Encoder / Decoder

HTML Entity Encoder / Decoder

Base32 Encoder / Decoder

Base58 Encoder / Decoder

Base64 Encoder / Decoder

Base64 Image Encoder / Decoder

JWT Decoder

Converters

JavaScript / JSON Converter

CSV / JSON Converter

JSON / XML Converter

JSON / PHP Array Converter

Text / HEX Converter

Base Converter

Unit Converter

UNIX Timestamp Converter

Image Tools

Color Picker

QR Code Generator

QR Code Reader

EXIF Viewer

Network Tools

My IP

IP Lookup

IP / Number Converter

CIDR / IP Converter

WHOIS Lookup

---
id: 6068c062-627f-4d7c-9250-5059f5417726 # UUIDv4
title: some title for your detection rule
description: a short sentence about the detection rule
references:
  - reference URL 1
  - reference URL 2
analyst_notes: >
  When you see X, you need to check if occurances of A, B, C, D are also there?
  If not, it might indicate a false-positive or a scenario 1 like in Alpha.
  If you see at most 3 out of 4, it is surely suspicious and therefore you should
  look for to find: K, L, M, N.  
query: >
  SELECT * FROM registry WHERE 
  key LIKE 'HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%%' 
  and name='Debugger';",  
mitre:
  - T1112
jira: PJ-1337

$ yamllint detection_rule.yml
detection_rule.yml
  2:42      warning  too few spaces before comment  (comments)
  11:81     error    line too long (81 > 80 characters)  (line-length)
  15:81     error    line too long (102 > 80 characters)  (line-length)

import yamllint
from yamllint.config import YamlLintConfig

raw_yaml = open('detection_rule.yml', 'r').read()

yaml_config = YamlLintConfig("extends: default")

for p in yamllint.linter.run(raw_yaml, yaml_config):
    print(p.desc, p.line, p.rule)

id: str()
title: str()
description: str()
references: list(str())
analyst_notes: str()
query: str()
mitre: list(str())
jira: str()

$ yamale -s schema.yaml detection_rule.yml
Validating /home/user/project-x/detection_rule.yml...
Validation success! 👍

import yamale
import uuid
from yamale.validators import DefaultValidators, Validator

class UUID(Validator):
    """ Custom UUID validator """
    tag = 'uuid'

    def _is_valid(self, value):
        try:
            luuid = uuid.UUID(str(value))
        except ValueError:
            return False
        return True

validators = DefaultValidators.copy()  # This is a dictionary
validators[UUID.tag] = UUID
schema = yamale.make_schema('./schema.yaml', validators=validators)

data = yamale.make_data('./detection_rule.yml')

try:
    yamale.validate(schema, data)
    print('Validation success! 👍')
except ValueError as e:
    print('Validation failed!n%s' % str(e))
    exit(1)

$ python schema-validate.py
Validation success! 👍

import re
from yamale.validators import Regex

class JIRA(Regex):
    """ Custom JIRA Project ID validator. """
    tag = 'jira'

    def __init__(self, *args, **kwargs):
        self._project_key = str(kwargs.pop('project_key', ''))
        super(JIRA, self).__init__(*args, **kwargs)

        if len(self._project_key) > 0:
            self.regexes = [
                re.compile("^%s-d+$" % (self._project_key))
            ]
        else:
            self.regexes = [
                re.compile("^([A-Z]{2}[0-9]{2})-d+$"),
                re.compile("^([A-Z][A-Z_0-9]+)-d+$"),
            ]

Validation failed!
Error validating data './detection_rule.yml' with schema './schema.yaml'
	jira: 'PJ-1337' is not a jira match.

---
title: str(min=1, max=256)
id: str()
status: enum('stable', 'testing', 'experimental', required=False)
description: str(required=False)
author: str(required=False)
date: str()
modified: str()
references: list(str(), required=False)
tags: list(str())
logsource: include('logsource')
detection: include('detection')
falsepositives: any(str(), list(), required=False)
level: enum('low', 'medium', 'high', 'critical', required=False)
---
logsource:
  product: str(required=False)
  category: str(required=False)
  service: str(required=False)
  definition: str(required=False)
---
detection:
  selection: any(str(), list(), map(key=str()))
  condition: str()
  timeframe: str(required=False)

---
id: 6068c062-627f-4d7c-9250-5059f5417726
title: some title for your detection rule
description: a short sentence about the detection rule
references:
  - reference URL 1
  - reference URL 2
analyst_notes: >
  When you see X, you need to check if occurances of A, B, C, D are also there?
  If not, it might indicate a false-positive or a scenario 1 like in Alpha.
  If you see at most 3 out of 4, it is surely suspicious and therefore you should
  look for to find: K, L, M, N.  
query:
  SELECT * FROM registry WHERE 
  key LIKE 'HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%%' 
  and name='Debugger';",
mitre:
  - T1112
jira: PJ-1337

id: uuid()
title: str()
description: str()
references: list(str())
analyst_notes: str()
query: str()
mitre: list(str())
jira: jira()

import yamale
import uuid
import re
from yamale.validators import DefaultValidators, Validator, Regex

class UUID(Validator):
    """ Custom UUID validator """
    tag = 'uuid'

    def __init__(self, *args, **kwargs):
        super(UUID, self).__init__(*args, **kwargs)
        self._version = int(kwargs.pop('version', 4))

    def _is_valid(self, value):
        try:
            luuid = uuid.UUID(str(value), version=self._version)
        except ValueError:
            return False
        return True

class JIRA(Regex):
    """ Custom JIRA Project ID validator. """
    tag = 'jira'

    def __init__(self, *args, **kwargs):
        self._project_key = str(kwargs.pop('project_key', ''))
        super(JIRA, self).__init__(*args, **kwargs)

        if len(self._project_key) > 0:
            self.regexes = [
                re.compile("^%s-d+$" % (self._project_key))
            ]
        else:
            self.regexes = [
                re.compile("^([A-Z]{2}[0-9]{2})-d+$"),
                re.compile("^([A-Z][A-Z_0-9]+)-d+$"),
            ]

validators = DefaultValidators.copy()  # This is a dictionary
validators[UUID.tag] = UUID
validators[JIRA.tag] = JIRA
schema = yamale.make_schema('./schema.yaml', validators=validators)

data = yamale.make_data('./detection_rule.yml')

try:
    yamale.validate(schema, data)
    print('Validation success! 👍')
except ValueError as e:
    print('Validation failed!n%s' % str(e))
    exit(1)