Skip to content

fix(correlations): raise SigmaCorrelationConditionError for infinite condition counts - #542

Merged
thomaspatzke merged 1 commit into
SigmaHQ:mainfrom
cristianchiriac:fix/correlation-condition-non-finite-count
Sep 20, 2026
Merged

thomaspatzke merged 1 commit into
SigmaHQ:mainfrom
cristianchiriac:fix/correlation-condition-non-finite-count

Conversation

@cristianchiriac

Copy link
Copy Markdown
Contributor

Problem

A correlation condition with an infinite count raises a raw OverflowError instead of a SigmaError:

correlation:
    type: event_count
    rules: base_rule
    group-by: [N]
    timespan: 5m
    condition:
        gte: .inf
OverflowError: cannot convert float infinity to integer

.inf is a valid YAML float, so this is reachable from rule files. Tooling that catches SigmaError to report bad rules crashes instead.

Root cause

SigmaCorrelationCondition.from_dict() converts the count with int() but only catches ValueError. int(float("inf")) raises OverflowError. NaN already raises ValueError and is reported correctly.

Fix

Also catch OverflowError, so the existing SigmaCorrelationConditionError ("... is no valid Sigma correlation condition count") is raised. This is the same approach as #526 for SigmaNumber.

Tests

  • test_correlation_condition_non_finite_count for inf and -inf. Both fail with OverflowError without the fix.
  • Full test suite (excluding online tests), black --check and mypy pass locally.

@thomaspatzke
thomaspatzke merged commit a7f5dd0 into SigmaHQ:main Sep 20, 2026
20 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants