Skip to content

TypeError when attempting to convert rule with --module option #51

Description

@kswagler-rh

When attempting to convert a rule with the --Module/-M option a TypeError: cannot unpack non-iterable NoneType object is raised

droid rules convert -c /droid_config.toml -M -p splunk --rules /sigma/linux/lnx_syslog_security_tools_disabling_syslog.yml
2026-03-16 15:17:40 INFO     Convert mode was selected - path selected: /sigma/linux/lnx_syslog_security_tools_disabling_syslog.yml          
╭──────────────────────────────────────────────────── Traceback (most recent call last) ────────────────────────────────────────────────────╮
│ /usr/local/lib/python3.14/site-packages/droid/commands/rules/convert.py:60 in convert                                                     │
│                                                                                                                                           │
│   57 │   │   logger.info("Raw rules are not subject to Sigma conversion.")                                                                │
│   58 │   │   raise typer.Exit(code=0)                                                                                                     │
│   59 │                                                                                                                                    │
│ ❱ 60 │   conversion_error, _search_warning = convert_rules(                                                                               │
│   61 │   │   params,                                                                                                                      │
│   62 │   │   load_platform_config(params, config_file),                                                                                   │
│   63 │   │   base_config,                                                                                                                 │
│                                                                                                                                           │
│ /usr/local/lib/python3.14/site-packages/droid/convert.py:370 in convert_rules                                                             │
│                                                                                                                                           │
│   367 │   │   │   return error, search_warning                                                                                            │
│   368 │                                                                                                                                   │
│   369 │   elif path.is_file():                                                                                                            │
│ ❱ 370 │   │   error, search_warning = convert_sigma_rule(path, parameters, logger, sigma_objec                                            │
│   371 │   │   if parameters.module:                                                                                                       │
│   372 │   │   │   rules.append(error)                                                                                                     │
│   373 │   else:                                                                                                                           │
│                                                                                                                                           │
│ /usr/local/lib/python3.14/site-packages/droid/convert.py:246 in convert_sigma_rule                                                        │
│                                                                                                                                           │
│   243 │                                                                                                                                   │
│   244 │   rule_content = load_rule(rule_file)                                                                                             │
│   245 │   sigma_objects[rule_content["title"]] = rule_content                                                                             │
│ ❱ 246 │   error, search_warning = convert_sigma(parameters, logger, rule_content, rule_file, t                                            │
│   247 │   return error, search_warning                                                                                                    │
│   248                                                                                                                                     │
│   249 def convert_rules(parameters, droid_config, base_config, logger_param):                                                             │
╰───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
TypeError: cannot unpack non-iterable NoneType object

When running without the -M option this error is not raised

droid rules convert -c /droid_config.toml -p splunk --rules /sigma/linux/lnx_syslog_security_tools_disabling_syslog.yml
2026-03-16 15:17:23 INFO     Convert mode was selected - path selected: /sigma/linux/lnx_syslog_security_tools_disabling_syslog.yml          
                    INFO     Successfully converted the rules   

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions