add: [rule-validation] Rule validation object and validates relationship

README.md

@@ -407,6 +407,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID
 - [objects/rmm](https://github.com/MISP/misp-objects/blob/main/objects/rmm/definition.json) - An object describing a RMM agent.
 - [objects/rogue-dns](https://github.com/MISP/misp-objects/blob/main/objects/rogue-dns/definition.json) - Rogue DNS as defined by CERT.br.
 - [objects/rtir](https://github.com/MISP/misp-objects/blob/main/objects/rtir/definition.json) - RTIR - Request Tracker for Incident Response.
+- [objects/rule-validation](https://github.com/MISP/misp-objects/blob/main/objects/rule-validation/definition.json) - Result of the syntax validation of a detection rule (YARA, Sigma, Suricata, Zeek...).
 - [objects/sandbox-report](https://github.com/MISP/misp-objects/blob/main/objects/sandbox-report/definition.json) - Sandbox report.
 - [objects/sb-signature](https://github.com/MISP/misp-objects/blob/main/objects/sb-signature/definition.json) - Sandbox detection signature.
 - [objects/scan-result](https://github.com/MISP/misp-objects/blob/main/objects/scan-result/definition.json) - Scan result object to add meta-data and the output of the scan result by itself.

objects/rule-validation/definition.json

@@ -0,0 +1,67 @@
+{
+  "attributes": {
+    "error": {
+      "description": "Syntax error reported by the validator",
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 1
+    },
+    "format": {
+      "description": "Format of the validated rule",
+      "misp-attribute": "text",
+      "sane_default": [
+        "yara",
+        "sigma",
+        "suricata",
+        "zeek",
+        "wazuh",
+        "nse",
+        "crs",
+        "nova",
+        "splunk",
+        "elastic",
+        "sagan",
+        "kql",
+        "atr",
+        "plum",
+        "kunai"
+      ],
+      "ui-priority": 1
+    },
+    "valid": {
+      "description": "Whether the rule is syntactically valid",
+      "misp-attribute": "boolean",
+      "ui-priority": 1
+    },
+    "validation-date": {
+      "description": "Date of the validation",
+      "misp-attribute": "datetime",
+      "ui-priority": 0
+    },
+    "validator": {
+      "description": "Name of the validator used",
+      "misp-attribute": "text",
+      "ui-priority": 0
+    },
+    "validator-url": {
+      "description": "URL of the validator instance used",
+      "misp-attribute": "link",
+      "ui-priority": 0
+    },
+    "warning": {
+      "description": "Warning reported by the validator",
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 0
+    }
+  },
+  "description": "Result of the syntax validation of a detection rule (YARA, Sigma, Suricata, Zeek...).",
+  "meta-category": "misc",
+  "name": "rule-validation",
+  "required": [
+    "format",
+    "valid"
+  ],
+  "uuid": "55712239-ddd6-4235-9848-5f103ebde55b",
+  "version": 1
+}

relationships/definition.json

@@ -2418,7 +2418,23 @@
       ],
       "name": "manufactured-by",
       "opposite": "manufactures"
+    },
+    {
+      "description": "The source object holds the validation result of the target object (e.g. the syntax validation of a detection rule).",
+      "format": [
+        "misp"
+      ],
+      "name": "validates",
+      "opposite": "validated-by"
+    },
+    {
+      "description": "The source object is validated by the target object, which holds the validation result.",
+      "format": [
+        "misp"
+      ],
+      "name": "validated-by",
+      "opposite": "validates"
     }
   ],
-  "version": 54
+  "version": 55
 }