Fixed MatchValueCondition: incopmpatible types result in false result

SigmaHQ · Jan 2, 2025 · 8d58a74 · 8d58a74
1 parent ca147ec
commit 8d58a74
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/sigma/processing/conditions/values.py b/sigma/processing/conditions/values.py
@@ -51,7 +51,10 @@ class MatchValueCondition(ValueProcessingCondition):
     value: Union[str, int, float, bool]
 
     def match_value(self, value: SigmaType) -> bool:
-        return value == self.value
+        try:
+            return value == self.value
+        except NotImplementedError:
+            return False
 
 
 class ContainsWildcardCondition(ValueProcessingCondition):

diff --git a/tests/test_processing_conditions.py b/tests/test_processing_conditions.py
@@ -462,6 +462,12 @@ def test_match_value_condition_bool_nomatch():
     )
 
 
+def test_match_value_condition_incompatible_type():
+    assert not MatchValueCondition(value=123, cond="any").match(
+        SigmaDetectionItem("field", [], [SigmaString("123")])
+    )
+
+
 def test_contains_wildcard_condition_match():
     assert ContainsWildcardCondition(cond="any").match(
         SigmaDetectionItem("field", [], [SigmaString("*")])