From 22957d56a69cf07b68b2c107de49ae34cac3da3a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 15 Apr 2026 15:12:13 +0000 Subject: [PATCH] fix: defer MITRE ATT&CK data imports in analyze.py to prevent network requests on CLI startup Agent-Logs-Url: https://github.com/SigmaHQ/sigma-cli/sessions/6807949e-b72e-452b-80df-8795263fd99a Co-authored-by: thomaspatzke <1845601+thomaspatzke@users.noreply.github.com> --- sigma/cli/analyze.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/sigma/cli/analyze.py b/sigma/cli/analyze.py index 86fbc0e..cb3f423 100644 --- a/sigma/cli/analyze.py +++ b/sigma/cli/analyze.py @@ -8,10 +8,6 @@ from sigma.cli.rules import check_rule_errors, load_rules from sigma.analyze.attack import score_functions, calculate_attack_scores from sigma.analyze.fields import extract_fields_from_collection -from sigma.data.mitre_attack import ( - mitre_attack_techniques_tactics_mapping, - mitre_attack_version, -) from sigma.analyze.stats import create_logsourcestats, format_row from sigma.rule import SigmaLevel, SigmaStatus from sigma.plugins import InstalledSigmaPlugins @@ -118,6 +114,11 @@ def analyze_attack( min_sigmastatus = SigmaStatus[min_status.upper()] except: min_sigmastatus = SigmaStatus.UNSUPPORTED + from sigma.data.mitre_attack import ( + mitre_attack_techniques_tactics_mapping, + mitre_attack_version, + ) + rules = load_rules(input, file_pattern) check_rule_errors(rules) score_function = score_functions[function][0]