|
1 | | -from app.converter.backends.microsoft.siem_functions.aggregation import AlaAggregationFunctionRender |
2 | | -from app.converter.backends.microsoft.siem_functions.search import AlaSearchFunctionRender |
3 | | -from app.converter.backends.microsoft.siem_functions.sort import AlaSortFunctionRender |
4 | | -from app.converter.backends.microsoft.siem_functions.table import AlaTableFunctionRender |
5 | 1 | from app.converter.core.functions import Functions |
6 | | -from app.converter.core.models.functions.aggregation import AggregationExpression |
7 | | -from app.converter.core.models.functions.search import SearchExpression |
8 | | -from app.converter.core.models.functions.sort import SortExpression |
9 | | -from app.converter.core.models.functions.table import TableExpression |
10 | 2 | from app.converter.core.models.functions.types import ParsedFunctions, NotSupportedFunction |
11 | 3 |
|
12 | 4 |
|
13 | 5 | class MicroSoftQueryFunctions(Functions): |
14 | 6 |
|
15 | | - render_functions_map = { |
16 | | - SortExpression: AlaSortFunctionRender, |
17 | | - SearchExpression: AlaSearchFunctionRender, |
18 | | - AggregationExpression: AlaAggregationFunctionRender, |
19 | | - TableExpression: AlaTableFunctionRender, |
20 | | - # WhereExpression: AlaWhereFunctionRender |
21 | | - } |
22 | | - |
23 | | - def render(self, functions: list): |
24 | | - query = "| " |
25 | | - funcs = [] |
26 | | - for function in functions: |
27 | | - if render_class := self.render_functions_map.get(type(function)): |
28 | | - funcs.append(render_class(function).render()) |
29 | | - query += " | ".join(funcs) |
30 | | - query = query.rstrip(" ") |
31 | | - return query |
32 | | - |
33 | 7 | def parse(self, query: str): |
34 | 8 | result = [] |
35 | 9 | functions = query.split(self.function_delimiter) |
|
0 commit comments