shows new highlighted fields from imported sysmon

Author: Infinit3i

gui/rule_editor.py

@@ -7,8 +7,10 @@
     QLineEdit,
     QPushButton,
     QListWidget,
+    QListWidgetItem,
 )
 from models.sysmon_config import RuleFilter, SysmonConfig
+from PySide6.QtGui import QColor
 
 
 class RuleEditor(QWidget):
@@ -113,7 +115,12 @@ def refresh_rules(self) -> None:
                     f"{rule.condition} | "
                     f"{rule.value}"
                 )
-                self.rule_list.addItem(rule_text)
+                item = QListWidgetItem(rule_text)
+
+                if not rule.imported:
+                    item.setBackground(QColor("#ffe6cc"))  # light orange
+
+                self.rule_list.addItem(item)
                 self.displayed_rules.append((event_id, rule_index))
 
     def add_rule(self) -> None:

importers/xml_importer.py

@@ -31,6 +31,7 @@ def extract_rules_from_node(
                 field_name=field_name,
                 condition=condition,
                 value=value,
+                imported=True,
             )
         )
 

models/sysmon_config.py

@@ -8,6 +8,7 @@ class RuleFilter:
     field_name: str
     condition: str
     value: str
+    imported: bool = False
 
 
 @dataclass