From 4610255f07b11cf796c3c95fb4e6f3dd65c55e8d Mon Sep 17 00:00:00 2001
From: ecrou-exact <geffetheo@gmail.com>
Date: Wed, 7 Oct 2026 10:15:11 +0200
Subject: [PATCH] add: [rule-validation] Rule validation object and validates
 relationship

New rule-validation object holding the result of the syntax validation of
a detection rule (format, validity, errors, warnings, validator), as
returned by the Rulezet validator expansion module of misp-modules.

Also add the validates / validated-by relationships, used to link the
validation result to the validated rule attribute or object.
---
 README.md                               |  1 +
 objects/rule-validation/definition.json | 67 +++++++++++++++++++++++++
 relationships/definition.json           | 18 ++++++-
 3 files changed, 85 insertions(+), 1 deletion(-)
 create mode 100644 objects/rule-validation/definition.json

diff --git a/README.md b/README.md
index 80dd881f..5f107a49 100644
--- a/README.md
+++ b/README.md
@@ -407,6 +407,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID
 - [objects/rmm](https://github.com/MISP/misp-objects/blob/main/objects/rmm/definition.json) - An object describing a RMM agent.
 - [objects/rogue-dns](https://github.com/MISP/misp-objects/blob/main/objects/rogue-dns/definition.json) - Rogue DNS as defined by CERT.br.
 - [objects/rtir](https://github.com/MISP/misp-objects/blob/main/objects/rtir/definition.json) - RTIR - Request Tracker for Incident Response.
+- [objects/rule-validation](https://github.com/MISP/misp-objects/blob/main/objects/rule-validation/definition.json) - Result of the syntax validation of a detection rule (YARA, Sigma, Suricata, Zeek...).
 - [objects/sandbox-report](https://github.com/MISP/misp-objects/blob/main/objects/sandbox-report/definition.json) - Sandbox report.
 - [objects/sb-signature](https://github.com/MISP/misp-objects/blob/main/objects/sb-signature/definition.json) - Sandbox detection signature.
 - [objects/scan-result](https://github.com/MISP/misp-objects/blob/main/objects/scan-result/definition.json) - Scan result object to add meta-data and the output of the scan result by itself.
diff --git a/objects/rule-validation/definition.json b/objects/rule-validation/definition.json
new file mode 100644
index 00000000..3f118b9d
--- /dev/null
+++ b/objects/rule-validation/definition.json
@@ -0,0 +1,67 @@
+{
+  "attributes": {
+    "error": {
+      "description": "Syntax error reported by the validator",
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 1
+    },
+    "format": {
+      "description": "Format of the validated rule",
+      "misp-attribute": "text",
+      "sane_default": [
+        "yara",
+        "sigma",
+        "suricata",
+        "zeek",
+        "wazuh",
+        "nse",
+        "crs",
+        "nova",
+        "splunk",
+        "elastic",
+        "sagan",
+        "kql",
+        "atr",
+        "plum",
+        "kunai"
+      ],
+      "ui-priority": 1
+    },
+    "valid": {
+      "description": "Whether the rule is syntactically valid",
+      "misp-attribute": "boolean",
+      "ui-priority": 1
+    },
+    "validation-date": {
+      "description": "Date of the validation",
+      "misp-attribute": "datetime",
+      "ui-priority": 0
+    },
+    "validator": {
+      "description": "Name of the validator used",
+      "misp-attribute": "text",
+      "ui-priority": 0
+    },
+    "validator-url": {
+      "description": "URL of the validator instance used",
+      "misp-attribute": "link",
+      "ui-priority": 0
+    },
+    "warning": {
+      "description": "Warning reported by the validator",
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 0
+    }
+  },
+  "description": "Result of the syntax validation of a detection rule (YARA, Sigma, Suricata, Zeek...).",
+  "meta-category": "misc",
+  "name": "rule-validation",
+  "required": [
+    "format",
+    "valid"
+  ],
+  "uuid": "55712239-ddd6-4235-9848-5f103ebde55b",
+  "version": 1
+}
\ No newline at end of file
diff --git a/relationships/definition.json b/relationships/definition.json
index eeb5e90a..2e4589ab 100644
--- a/relationships/definition.json
+++ b/relationships/definition.json
@@ -2418,7 +2418,23 @@
       ],
       "name": "manufactured-by",
       "opposite": "manufactures"
+    },
+    {
+      "description": "The source object holds the validation result of the target object (e.g. the syntax validation of a detection rule).",
+      "format": [
+        "misp"
+      ],
+      "name": "validates",
+      "opposite": "validated-by"
+    },
+    {
+      "description": "The source object is validated by the target object, which holds the validation result.",
+      "format": [
+        "misp"
+      ],
+      "name": "validated-by",
+      "opposite": "validates"
     }
   ],
-  "version": 54
+  "version": 55
 }
\ No newline at end of file