integrated trigger into rule, fixed parameters, doesn't show root rule anymore

This commit is contained in:
Michael Clemens 2018-03-19 22:56:52 +01:00
parent 694f9249e4
commit 70aeee0e00

View File

@ -20,6 +20,7 @@ Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
import sys import sys
import os.path import os.path
import re
from configparser import ConfigParser from configparser import ConfigParser
from lxml import etree from lxml import etree
@ -54,6 +55,8 @@ def line(level,key,value):
value_style + value + value_style + "\n" value_style + value + value_style + "\n"
else: output = "" else: output = ""
output = re.sub('\$\$$',"]",output)
output = re.sub('\$\$',"PARAMETER:[",output)
return output return output
@ -133,51 +136,49 @@ def main(xmlfile,outfile):
file.write(line(1,param.get('name'),"N/A")) file.write(line(1,param.get('name'),"N/A"))
file.write(line(2,"Description:",param.get('description'))) file.write(line(2,"Description:",param.get('description')))
file.write(line(2,"Default Value:",param.get('defaultvalue'))) file.write(line(2,"Default Value:",param.get('defaultvalue')))
# Print trigger information (Sequence, Timeout, Time Unit, Threshold)
triggers = False
for trigger in cdata.getiterator('trigger'):
if not triggers:
file.write("\n### Triggers\n")
triggers = True
file.write(line(1,trigger.get('name'),"N/A"))
file.write(line(2,"Timeout:",trigger.get('timeout')))
file.write(line(2,"Time Units:",trigger.get('timeUnit')))
file.write(line(2,"Threshold:",trigger.get('threshold')))
file.write(line(2,"Sequence:",trigger.get('ordered')))
file.write("\n### Rules\n") file.write("\n### Rules\n")
# Parse CDATA element and print correlation rule match blocks # Parse CDATA element and print correlation rule match blocks
for r in cdata.getiterator('rule'): for r in cdata.getiterator('rule'):
o = "" o = ""
v = "" v = ""
t = "" t = ""
file.write("\n#### " + r.get('name') + "\n") if not r.get('name') == "Root Rule":
for e in r.iter(): file.write("\n#### " + r.get('name') + "\n")
if str(e.tag) == 'activate': for e in r.iter():
file.write(line(1,"Activate:",e.get('type'))) if str(e.tag) == 'activate':
if str(e.tag) == 'action': file.write(line(1,"Activate:",e.get('type')))
file.write(line(1,"Action","N/A")) if str(e.tag) == 'action':
file.write(line(2,"Type:",e.get('type'))) if e.get('type') == "TRIGGER":
file.write(line(2,"Trigger:",e.get('trigger'))) file.write(line(1,"Action:","Trigger"))
if str(e.tag) == 'match': for trigger in cdata.getiterator('trigger'):
file.write(line(1,"Match","N/A")) if e.get('trigger') == trigger.get('name'):
file.write(line(2,"Count:",e.get('count'))) file.write(line(2,"Timeout:",trigger.get('timeout')))
file.write(line(2,"Match Type:",e.get('matchType'))) file.write(line(2,"Time Units:",trigger.get('timeUnit')))
if str(e.tag) == 'matchFilter': file.write(line(2,"Threshold:",trigger.get('threshold')))
file.write(line(1,"Match Filter","N/A")) file.write(line(2,"Sequence:",trigger.get('ordered')))
file.write(line(2,"Logical Element Type:",e.get('type'))) else:
if str(e.tag) == 'singleFilterComponent': file.write(line(1,"Action","N/A"))
t = e.get('type') file.write(line(2,"NOT IMPLEMENTED","N/A"))
if str(e.tag) == 'filterData': if str(e.tag) == 'match':
if (e.get('name') == "operator"): file.write(line(1,"Match Type:",e.get('matchType')))
o = e.get('value') file.write(line(2,"Count:",e.get('count')))
if (e.get('name') == "value"): #file.write(line(2,"Match Type:",e.get('matchType')))
v = e.get('value') if str(e.tag) == 'matchFilter':
if o and v and t: file.write(line(1,"Match Filter:",e.get('type').upper()))
file.write(line(2,"Filter Component","N/A")) #file.write(line(2,"Logical Element Type:",e.get('type').upper()))
file.write(line(3,"Condition:","'" + t + "' " + o + " '" \ if str(e.tag) == 'singleFilterComponent':
+ v + "'")) t = e.get('type')
v = "" if str(e.tag) == 'filterData':
o = "" if (e.get('name') == "operator"):
o = e.get('value')
if (e.get('name') == "value"):
v = e.get('value')
if o and v and t:
file.write(line(2,"Filter Component","N/A"))
file.write(line(3,"Condition:","'" + t + "' " + o + " '" \
+ v + "'"))
v = ""
o = ""
file.write("\n\\newpage\n") file.write("\n\\newpage\n")
file.close() file.close()