added support for multiple tags, added comments

This commit is contained in:
Michael Clemens 2018-03-17 13:39:55 +01:00
parent fb74519e9d
commit 6bd9e129cb

View File

@ -9,13 +9,17 @@ def main(xmlfile,outfile):
root = etree.parse(xmlfile) root = etree.parse(xmlfile)
for rule in root.getiterator('rule'): for rule in root.getiterator('rule'):
# Get CDATA
text = rule.findtext('text') text = rule.findtext('text')
cdata = etree.fromstring(text) cdata = etree.fromstring(text)
# Print rule name as header
message = "# " + rule.findtext('message') message = "# " + rule.findtext('message')
file.write(message + "\n") file.write(message + "\n")
# Print rule description
description = rule.findtext('description') description = rule.findtext('description')
file.write("## Description\n") file.write("## Description\n")
file.write(description +"\n") file.write(description +"\n")
# Print general rule information (ID, Normalization, Severity, all Tags, Group By)
file.write("## General Information\n") file.write("## General Information\n")
ruleid = "* Rule ID: " + rule.findtext('id') ruleid = "* Rule ID: " + rule.findtext('id')
file.write(ruleid +"\n") file.write(ruleid +"\n")
@ -23,18 +27,19 @@ def main(xmlfile,outfile):
file.write(normalization + "\n") file.write(normalization + "\n")
severity = "* Severity: " + rule.findtext('severity') severity = "* Severity: " + rule.findtext('severity')
file.write(severity + "\n") file.write(severity + "\n")
if (rule.findtext('tag')): for tags in rule.getiterator('tag'):
tag = "* Tag: " + rule.findtext('tag') file.write("* Tag: " + tags.text + "\n")
file.write(tag + "\n")
for x in cdata.getiterator('ruleset'): for x in cdata.getiterator('ruleset'):
correlationField = "* Group By: " + x.get('correlationField') correlationField = "* Group By: " + x.get('correlationField')
file.write(correlationField + "\n") file.write(correlationField + "\n")
file.write("## Correlation Details\n") file.write("## Correlation Details\n")
# Print rule parameters
file.write("### Parameters\n") file.write("### Parameters\n")
for p in cdata.getiterator('param'): for p in cdata.getiterator('param'):
file.write("* Name: " + p.get('name') + "\n") file.write("* Name: " + p.get('name') + "\n")
file.write(" - Description: " + p.get('description') + "\n") file.write(" - Description: " + p.get('description') + "\n")
file.write(" - Default Value: " + p.get('defaultvalue') + "\n") file.write(" - Default Value: " + p.get('defaultvalue') + "\n")
# Print trigger information (Ordered, Timeout, Time Unit, Threshold)
file.write("### Trigger\n") file.write("### Trigger\n")
for t in cdata.getiterator('trigger'): for t in cdata.getiterator('trigger'):
if (t.get('ordered')): if (t.get('ordered')):
@ -50,13 +55,10 @@ def main(xmlfile,outfile):
trigger_threshold = "* Threshold: " + str(t.get('threshold')) trigger_threshold = "* Threshold: " + str(t.get('threshold'))
file.write(trigger_threshold + "\n") file.write(trigger_threshold + "\n")
file.write("### Rules\n") file.write("### Rules\n")
# Parse CDATA element # Parse CDATA element and print correlation rule match blocks
for r in cdata.getiterator('rule'): for r in cdata.getiterator('rule'):
file.write("#### Name: " + r.get('name') + "\n") file.write("#### Name: " + r.get('name') + "\n")
for e in r.iter(): for e in r.iter():
op = ""
type = ""
value = ""
if str(e.tag) == 'match': if str(e.tag) == 'match':
file.write("* Match: \n") file.write("* Match: \n")
if (e.get('count')): if (e.get('count')):