intelmq.bots.experts.sieve package¶
Submodules¶
intelmq.bots.experts.sieve.expert module¶
SieveExpertBot filters and modifies events based on a specification language similar to mail sieve.
- param file
string
-
intelmq.bots.experts.sieve.expert.
BOT
¶
-
class
intelmq.bots.experts.sieve.expert.
Procedure
(value)¶ Bases:
enum.Enum
An enumeration.
-
CONTINUE
= 1¶
-
DROP
= 3¶
-
KEEP
= 2¶
-
-
class
intelmq.bots.experts.sieve.expert.
SieveExpertBot
(bot_id: str, start: bool = False, sighup_event=None, disable_multithreading: Optional[bool] = None)¶ Bases:
intelmq.lib.bot.Bot
Filter and modify events based on a sieve-based language
-
static
check
(parameters)¶ The bot’s own check function can perform individual checks on it’s parameters. init() is not called before, this is a staticmethod which does not require class initialization.
- Parameters
parameters – Bot’s parameters, defaults and runtime merged together
- Returns
- None or a list of [log_level, log_message] pairs, both
strings. log_level must be a valid log level.
- Return type
output
-
compute_basic_math
(action, event) → str¶
-
file
: str = '/opt/intelmq/var/lib/bots/sieve/filter.sieve'¶
-
static
get_linecol
(model_obj, as_dict=False)¶ Gets the position of a model object in the sieve file.
- Parameters
model_obj – the model object
as_dict – return the position as a dict instead of a tuple.
- Returns
Returns the line and column number for the model object’s position in the sieve file. Default return type is a tuple of (line,col). Optionally, returns a dict when as_dict == True.
-
init
() → None¶
-
static
init_metamodel
()¶
-
match_expression
(expr, event) → bool¶
-
process
() → None¶
-
process_action
(action, event) → intelmq.bots.experts.sieve.expert.Procedure¶
-
process_bool_match
(key, op, value, event)¶
-
process_branching
(rule, event) → intelmq.bots.experts.sieve.expert.Procedure¶
-
process_clause
(clause, event, else_clause=False) → Optional[intelmq.bots.experts.sieve.expert.Procedure]¶
-
process_condition
(cond, event) → bool¶
-
process_conjunction
(conj, event) → bool¶
-
static
process_exist_match
(key, op, event) → bool¶
-
process_ip_range_match
(key, ip_range, event) → bool¶
-
process_list_match
(key, op, value, event) → bool¶
-
process_multi_numeric_match
(key, op, value, event) → bool¶
-
process_multi_string_match
(key, op, value, event) → bool¶
-
process_single_numeric_match
(key, op, value, event) → bool¶
-
process_single_string_match
(key, op, value, event) → bool¶
-
process_statement
(statement, event)¶
-
static
read_sieve_file
(filename, metamodel)¶
-
static
validate_ip_address
(ipaddr) → None¶
-
static
validate_ip_range
(ip_range) → None¶
-
static
validate_numeric_match
(num_match) → None¶ Validates a numeric match expression.
Checks if the event key (given on the left hand side of the expression) is of a valid type for a numeric match, according the the IntelMQ harmonization.
- Raises
TextXSemanticError – when the key is of an incompatible type for numeric match expressions.
-
static
validate_string_match
(str_match) → None¶ Validates a string match expression.
Checks if the type of the value given on the right hand side of the expression matches the event key in the left hand side, according to the IntelMQ harmonization.
- Raises
TextXSemanticError – when the value is of incompatible type with the event key.
-
static