[medium] Honour -o for backends returning dict results

[elhoim]

BLUF

• Problem: when a backend returns a dict from convert(), the result is always printed to stdout. --output/-o is ignored.
• Impact: sigma convert -t <backend> -f <dict format> -o result.json rules/ exits 0, but result.json is never created and the JSON goes to the terminal or pipe instead.
• Fix: pass output to click.echo() in the dict branch, like every other result branch already does. This is a one-line change.
• Tests: a new CliRunner test (the test backend's convert() is monkeypatched to return a dict) checks that the JSON lands in the -o file and not on stdout. It fails on main and passes with the fix.

Priority: medium

Details

Root cause: sigma/cli/convert.py:584-585

elif isinstance(result, dict):
    click.echo(bytes(json.dumps(result, indent=json_indent), encoding))   # no `output`

The str, bytes, list-of-str and list-of-dict branches (convert.py:556, 563, 569, 575-583) all pass output. After the fix:

    click.echo(bytes(json.dumps(result, indent=json_indent), encoding), output)

No backend in this repository's test environment returns a plain dict, so the test simulates one by monkeypatching TextQueryTestBackend.convert. The rest of the CLI code runs unchanged.

Testing

• New test: tests/test_convert.py::test_convert_output_dict_to_file. It fails on main because the JSON is on stdout and the file is empty.
• Full suite, run the way CI runs it (Python 3.12, dependencies pinned to poetry.lock: pySigma 1.4.0, click 8.4.2, pyparsing 3.3.2): pytest --cov=sigma → 119 passed, 1 skipped.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟢 Approval recommended

The change is minimal, consistent with existing output handling, and includes a focused regression test that fails on main and passes with the fix.

Review effort: Lite
Findings: None

What changed in this PR

This PR fixes sigma convert so that when a backend’s convert() returns a plain dict, the CLI correctly honors --output/-o by writing the JSON to the provided output file instead of always emitting to stdout.

Changes:

• Pass the output file handle to click.echo() for the dict result branch in sigma/cli/convert.py.
• Add a regression test that monkeypatches the test backend to return a dict and asserts the JSON is written to the -o file (and not stdout).

File	Description
sigma/​cli/​convert.py	Fixes the dict output path to write via the configured --output/-o stream.
tests/​test_convert.py	Adds coverage ensuring dict results are written to the output file rather than stdout.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.