diff --git a/sigma/validators/core/tags.py b/sigma/validators/core/tags.py index 746d00fc..94d6c43b 100644 --- a/sigma/validators/core/tags.py +++ b/sigma/validators/core/tags.py @@ -180,7 +180,7 @@ class InvalidNamespaceTagIssue(SigmaValidationIssue): class NamespaceTagValidator(SigmaTagValidator): """Validate rule tag name""" - allowed_namespace = {"attack", "car", "cve", "detection", "stp"} + allowed_namespace = {"attack", "car", "stp", "cve", "tlp", "detection"} def validate_tag(self, tag: SigmaRuleTag) -> List[SigmaValidationIssue]: if tag.namespace not in self.allowed_namespace: diff --git a/tests/test_validators_tags.py b/tests/test_validators_tags.py index e6d3d975..2086ff64 100644 --- a/tests/test_validators_tags.py +++ b/tests/test_validators_tags.py @@ -178,7 +178,19 @@ def test_validator_duplicate_tags(): ["attaque.command_and_control"], InvalidNamespaceTagIssue, ), - (NamespaceTagValidator, ["cve.2023.007"], [], InvalidNamespaceTagIssue), + ( + NamespaceTagValidator, + [ + "attack.t1234", + "car.2016-04-005", + "stp.3k", + "cve.2023.007", + "tlp.amber", + "detection.threat_hunting", + ], + [], + InvalidNamespaceTagIssue, + ), ], ) def test_validator_optional_tag(opt_validator_class, opt_tags, opt_issue_tags, opt_issue_class):