Skip to content

Commit a8aaf6a

Browse files
dtsprmdtsprm
committed
regex-transformation-only-for-re
1 parent 825b00c commit a8aaf6a

File tree

2 files changed

+47
-24
lines changed

2 files changed

+47
-24
lines changed

‎translator/app/translator/platforms/logrhythm_axon/const.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
from app.translator.core.custom_types.meta_info import SeverityType
22
from app.translator.core.models.platform_details import PlatformDetails
33

4+
UNMAPPED_FIELD_DEFAULT_NAME = "general_information.raw_message"
5+
46
DEFAULT_LOGRHYTHM_AXON_RULE = {
57
"title": "Default LogRhythm Axon rule",
68
"version": 3,

‎translator/app/translator/platforms/logrhythm_axon/renders/logrhythm_axon_query.py

Lines changed: 45 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from typing import Union
2020

2121
from app.translator.const import DEFAULT_VALUE_TYPE
22-
from app.translator.core.custom_types.tokens import LogicalOperatorType, OperatorType
22+
from app.translator.core.custom_types.tokens import LogicalOperatorType
2323
from app.translator.core.exceptions.core import StrictPlatformException
2424
from app.translator.core.exceptions.render import BaseRenderException
2525
from app.translator.core.mapping import LogSourceSignature, SourceMapping
@@ -29,7 +29,7 @@
2929
from app.translator.core.models.parser_output import MetaInfoContainer
3030
from app.translator.core.models.platform_details import PlatformDetails
3131
from app.translator.core.render import BaseQueryFieldValue, BaseQueryRender
32-
from app.translator.platforms.logrhythm_axon.const import logrhythm_axon_query_details
32+
from app.translator.platforms.logrhythm_axon.const import UNMAPPED_FIELD_DEFAULT_NAME, logrhythm_axon_query_details
3333
from app.translator.platforms.logrhythm_axon.mapping import LogRhythmAxonMappings, logrhythm_axon_mappings
3434
from app.translator.platforms.microsoft.escape_manager import microsoft_escape_manager
3535

@@ -90,11 +90,26 @@ def __regex_to_str_list(self, value: Union[int, str]) -> list[list[str]]: # noq
9090

9191
return joined_components
9292

93+
def __unmapped_regex_field_to_contains_string(self, field: str, value: str) -> str:
94+
if self.__is_complex_regex(value):
95+
raise LogRhythmRegexRenderException
96+
values = self.__regex_to_str_list(value)
97+
return (
98+
"("
99+
+ self.or_token.join(
100+
" AND ".join(f'{field} CONTAINS "{self.__escape_value(value)}"' for value in value_list)
101+
for value_list in values
102+
)
103+
+ ")"
104+
)
105+
93106
@staticmethod
94107
def __escape_value(value: Union[int, str]) -> Union[int, str]:
95108
return value.replace("'", "''") if isinstance(value, str) else value
96109

97110
def equal_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
111+
if field == UNMAPPED_FIELD_DEFAULT_NAME:
112+
return self.contains_modifier(field, value)
98113
if isinstance(value, str):
99114
return f'{field} = "{self.__escape_value(value)}"'
100115
if isinstance(value, list):
@@ -104,26 +119,36 @@ def equal_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
104119
return f'{field} = "{self.apply_value(value)}"'
105120

106121
def less_modifier(self, field: str, value: Union[int, str]) -> str:
122+
if field == UNMAPPED_FIELD_DEFAULT_NAME:
123+
return self.contains_modifier(field, value)
107124
if isinstance(value, int):
108125
return f"{field} < {value}"
109126
return f"{field} < '{self.apply_value(value)}'"
110127

111128
def less_or_equal_modifier(self, field: str, value: Union[int, str]) -> str:
129+
if field == UNMAPPED_FIELD_DEFAULT_NAME:
130+
return self.contains_modifier(field, value)
112131
if isinstance(value, int):
113132
return f"{field} <= {value}"
114133
return f"{field} <= {self.apply_value(value)}"
115134

116135
def greater_modifier(self, field: str, value: Union[int, str]) -> str:
136+
if field == UNMAPPED_FIELD_DEFAULT_NAME:
137+
return self.contains_modifier(field, value)
117138
if isinstance(value, int):
118139
return f"{field} > {value}"
119140
return f"{field} > {self.apply_value(value)}"
120141

121142
def greater_or_equal_modifier(self, field: str, value: Union[int, str]) -> str:
143+
if field == UNMAPPED_FIELD_DEFAULT_NAME:
144+
return self.contains_modifier(field, value)
122145
if isinstance(value, int):
123146
return f"{field} >= {value}"
124147
return f"{field} >= {self.apply_value(value)}"
125148

126149
def not_equal_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
150+
if field == UNMAPPED_FIELD_DEFAULT_NAME:
151+
return self.contains_modifier(field, value)
127152
if isinstance(value, list):
128153
return f"({self.or_token.join([self.not_equal_modifier(field=field, value=v) for v in value])})"
129154
if isinstance(value, int):
@@ -133,39 +158,37 @@ def not_equal_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
133158
def contains_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
134159
if isinstance(value, list):
135160
return f"({self.or_token.join(self.contains_modifier(field=field, value=v) for v in value)})"
136-
if isinstance(value, str) and self.__is_contain_regex_items(value):
137-
if self.__is_complex_regex(value):
138-
raise LogRhythmRegexRenderException
139-
values = self.__regex_to_str_list(value)
140-
return (
141-
"("
142-
+ self.or_token.join(
143-
" AND ".join(f'{field} CONTAINS "{self.__escape_value(value)}"' for value in value_list)
144-
for value_list in values
145-
)
146-
+ ")"
147-
)
148161
return f'{field} CONTAINS "{self.__escape_value(value)}"'
149162

150163
def endswith_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
151164
if isinstance(value, list):
152165
return f"({self.or_token.join(self.endswith_modifier(field=field, value=v) for v in value)})"
153-
value = f".*{self.__escape_value(value)}" if not value.startswith(".*") else self.__escape_value(value)
166+
if isinstance(value, str) and field == UNMAPPED_FIELD_DEFAULT_NAME:
167+
return self.contains_modifier(field, value)
168+
value = f".*{self.__escape_value(value)}" if not str(value).startswith(".*") else self.__escape_value(value)
154169
return f'{field} matches "{value}$"'
155170

156171
def startswith_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
157172
if isinstance(value, list):
158173
return f"({self.or_token.join(self.startswith_modifier(field=field, value=v) for v in value)})"
159-
value = f"{self.__escape_value(value)}.*" if not value.endswith(".*") else self.__escape_value(value)
174+
if isinstance(value, str) and field == UNMAPPED_FIELD_DEFAULT_NAME:
175+
return self.contains_modifier(field, value)
176+
value = f"{self.__escape_value(value)}.*" if not str(value).endswith(".*") else self.__escape_value(value)
160177
return f'{field} matches "^{self.__escape_value(value)}"'
161178

162-
def __regex_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
163-
return f'{field} matches "{value}"'
164-
165179
def regex_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
180+
if field == UNMAPPED_FIELD_DEFAULT_NAME and self.__is_contain_regex_items(value):
181+
if isinstance(value, str):
182+
return self.__unmapped_regex_field_to_contains_string(field, value)
183+
if isinstance(value, list):
184+
return self.or_token.join(
185+
self.__unmapped_regex_field_to_contains_string(field=field, value=v) for v in value
186+
)
166187
if isinstance(value, list):
167-
return f"({self.or_token.join(self.__regex_modifier(field=field, value=v) for v in value)})"
168-
return self.__regex_modifier(field, value)
188+
return f"({self.or_token.join(self.regex_modifier(field=field, value=v) for v in value)})"
189+
if isinstance(value, str) and field == UNMAPPED_FIELD_DEFAULT_NAME:
190+
return self.contains_modifier(field, value)
191+
return f'{field} matches "{value}"'
169192

170193

171194
class LogRhythmAxonQueryRender(BaseQueryRender):
@@ -193,9 +216,7 @@ def apply_token(self, token: Union[FieldValue, Keyword, Identifier], source_mapp
193216
except StrictPlatformException:
194217
try:
195218
return self.field_value_map.apply_field_value(
196-
field="general_information.raw_message",
197-
operator=Identifier(token_type=OperatorType.CONTAINS),
198-
value=token.value,
219+
field=UNMAPPED_FIELD_DEFAULT_NAME, operator=token.operator, value=token.value
199220
)
200221
except LogRhythmRegexRenderException as exc:
201222
raise LogRhythmRegexRenderException(

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy