Repository: google/timesketch

Issue:
client.get_sigma_rule different result to client.get_sigma_rule_by_text
Running the following command:

```
rule = client.get_sigma_rule(rule_uuid='5266a592-b793-11ea-b3de-0242ac130004')
rule.es_query
``` 

Gives:
```
'*apt\\-get\\ install\\ zmap*'
```

Vs:
```
rule_text = """title: Suspicious Installation of Zenmap
id: 5266a592-b793-11ea-b3de-0242ac130004
description: Detects suspicious installation of Zenmap
references:
    - https://rmusser.net/docs/ATT&CK-Stuff/ATT&CK/Discovery.html
author: Alexander Jaeger
date: 2020/06/26
modified: 2020/06/26
tags:
    - attack.discovery
    - attack.t1046
logsource:
    product: linux
    service: shell
detection:
    keywords:
        # Generic suspicious commands
        - '*apt-get install zmap*'
    condition: keywords
falsepositives:
    - Unknown
level: high"""
rule2 = client.get_sigma_rule_by_text(rule_text)
rule2.es_query
```

Gives:

```'(data_type:("shell\\:zsh\\:history" OR "bash\\:history\\:command" OR "apt\\:history\\:line" OR "selinux\\:line") AND "*apt\\-get\\ install\\ zmap*")'
```


Discussion:

Resolving patch:
diff --git a/timesketch/lib/sigma_util.py b/timesketch/lib/sigma_util.py
--- a/timesketch/lib/sigma_util.py
+++ b/timesketch/lib/sigma_util.py
@@ -171,8 +171,10 @@ def get_sigma_rule(filepath, sigma_config=None):
         IsADirectoryError: If a directory is passed as filepath
     """
     try:
-        if sigma_config:
+        if isinstance(sigma_config, sigma_configuration.SigmaConfiguration):
             sigma_conf_obj = sigma_config
+        elif isinstance(sigma_config, str):
+            sigma_conf_obj = get_sigma_config_file(sigma_config)
         else:
             sigma_conf_obj = get_sigma_config_file()
     except ValueError as e:
@@ -205,7 +207,7 @@ def get_sigma_rule(filepath, sigma_config=None):
             for doc in rule_yaml_data:
                 rule_return.update(doc)
                 parser = sigma_collection.SigmaCollectionParser(
-                    str(doc), sigma_config, None)
+                    str(doc), sigma_conf_obj, None)
                 parsed_sigma_rules = parser.generate(sigma_backend)
 
         except NotImplementedError as exception:
@@ -263,17 +265,26 @@ def get_sigma_rule_by_text(rule_text, sigma_config=None):
         NotImplementedError: A feature in the provided Sigma rule is not
             implemented in Sigma for Timesketch
     """
-    if sigma_config is None:
-        sigma_config = get_sigma_config_file()
+    try:
+        if isinstance(sigma_config, sigma_configuration.SigmaConfiguration):
+            sigma_conf_obj = sigma_config
+        elif isinstance(sigma_config, str):
+            sigma_conf_obj = get_sigma_config_file(sigma_config)
+        else:
+            sigma_conf_obj = get_sigma_config_file()
+    except ValueError as e:
+        logger.error(
+            'Problem reading the Sigma config', exc_info=True)
+        raise ValueError('Problem reading the Sigma config') from e
 
-    sigma_backend = sigma_es.ElasticsearchQuerystringBackend(sigma_config, {})
+    sigma_backend = sigma_es.ElasticsearchQuerystringBackend(sigma_conf_obj, {})
 
     rule_return = {}
 
     # TODO check if input validation is needed / useful.
     try:
         parser = sigma_collection.SigmaCollectionParser(
-            rule_text, sigma_config, None)
+            rule_text, sigma_conf_obj, None)
         parsed_sigma_rules = parser.generate(sigma_backend)
         rule_yaml_data = yaml.safe_load_all(rule_text)
         for doc in rule_yaml_data:


Test patch:
diff --git a/timesketch/api/v1/resources_test.py b/timesketch/api/v1/resources_test.py
--- a/timesketch/api/v1/resources_test.py
+++ b/timesketch/api/v1/resources_test.py
@@ -405,7 +405,12 @@ class SigmaListResourceTest(BaseTest):
                     '*apt-get install zmap*'
                     ]
                 },
-            'es_query': '*apt\\-get\\ install\\ zmap*',
+            'es_query':
+                '(data_type:("shell\\:zsh\\:history" OR '\
+                '"bash\\:history\\:command" OR '\
+                '"apt\\:history\\:line" OR '\
+                '"selinux\\:line") AND '\
+                '"*apt\\-get\\ install\\ zmap*")',
             'falsepositives': ['Unknown'],
             'file_name': 'lnx_susp_zenmap.yml',
             'file_relpath': 'lnx_susp_zenmap.yml',