added styling options, nicer filter condition output

This commit is contained in:
Michael Clemens 2018-03-17 16:45:15 +01:00
parent d0a4595e35
commit bb39d5ff74

View File

@ -2,6 +2,7 @@
import sys import sys
from lxml import etree from lxml import etree
style="**"
def main(xmlfile,outfile): def main(xmlfile,outfile):
@ -21,67 +22,72 @@ def main(xmlfile,outfile):
file.write(description +"\n") file.write(description +"\n")
# Print general rule information (ID, Normalization, Severity, all Tags, Group By) # Print general rule information (ID, Normalization, Severity, all Tags, Group By)
file.write("## General Information\n") file.write("## General Information\n")
ruleid = "* Rule ID: " + rule.findtext('id') ruleid = "* " + style + "Rule ID:" + style + " " + rule.findtext('id')
file.write(ruleid +"\n") file.write(ruleid +"\n")
normalization = "* Normalization ID: " + rule.findtext('normid') normalization = "* " + style + "Normalization ID:" + style + " " + rule.findtext('normid')
file.write(normalization + "\n") file.write(normalization + "\n")
severity = "* Severity: " + rule.findtext('severity') severity = "* " + style + "Severity:" + style + " " + rule.findtext('severity')
file.write(severity + "\n") file.write(severity + "\n")
for tags in rule.getiterator('tag'): for tags in rule.getiterator('tag'):
file.write("* Tag: " + tags.text + "\n") file.write("* " + style + "Tag:" + style + " " + tags.text + "\n")
for rs in cdata.getiterator('ruleset'): for rs in cdata.getiterator('ruleset'):
correlationField = "* Group By: " + rs.get('correlationField') correlationField = "* " + style + "Group By:" + style + " " + rs.get('correlationField')
file.write(correlationField + "\n") file.write(correlationField + "\n")
file.write("## Correlation Details\n") file.write("## Correlation Details\n")
# Print rule parameters # Print rule parameters
file.write("### Parameters\n") file.write("### Parameters\n")
for param in cdata.getiterator('param'): for param in cdata.getiterator('param'):
file.write("* Name: " + param.get('name') + "\n") file.write("* " + style + "Name:" + style + " " + param.get('name') + "\n")
file.write(" - Description: " + param.get('description') + "\n") file.write(" - " + style + "Description:" + style + " " + param.get('description') + "\n")
file.write(" - Default Value: " + param.get('defaultvalue') + "\n") file.write(" - " + style + "Default Value:" + style + " " + param.get('defaultvalue') + "\n")
# Print trigger information (Sequence, Timeout, Time Unit, Threshold) # Print trigger information (Sequence, Timeout, Time Unit, Threshold)
file.write("### Trigger\n") file.write("### Trigger\n")
for trigger in cdata.getiterator('trigger'): for trigger in cdata.getiterator('trigger'):
if (trigger.get('name')): if (trigger.get('name')):
file.write("* Name: " + trigger.get('name') + "\n") file.write("* " + style + "Name:" + style + " " + trigger.get('name') + "\n")
file.write(" - Timeout: " + trigger.get('timeout') + "\n") file.write(" - " + style + "Timeout:" + style + " " + trigger.get('timeout') + " " + trigger.get('timeUnit') + "\n")
file.write(" - Time Unit: " + trigger.get('timeUnit') + "\n") file.write(" - " + style + "Threshold:" + style + " " + trigger.get('threshold') + "\n")
file.write(" - Threshold: " + trigger.get('threshold') + "\n")
if (trigger.get('ordered')): if (trigger.get('ordered')):
file.write(" - Sequence: " + trigger.get('ordered') + "\n") file.write(" - " + style + "Sequence:" + style + " " + trigger.get('ordered') + "\n")
file.write("### Rules\n") file.write("### Rules\n")
# Parse CDATA element and print correlation rule match blocks # Parse CDATA element and print correlation rule match blocks
for r in cdata.getiterator('rule'): for r in cdata.getiterator('rule'):
o = ""
v = ""
t = ""
file.write("#### " + r.get('name') + "\n") file.write("#### " + r.get('name') + "\n")
for e in r.iter(): for e in r.iter():
if str(e.tag) == 'activate': if str(e.tag) == 'activate':
file.write("* Activate: ") file.write("* " + style + "Activate:" + style + " ")
if (e.get('type')): if (e.get('type')):
file.write(e.get('type') + "\n") file.write(e.get('type') + "\n")
if str(e.tag) == 'action': if str(e.tag) == 'action':
file.write("* Action: \n") file.write("* " + style + "Action:" + style + " \n")
if (e.get('type')): if (e.get('type')):
file.write(" - Type: " + e.get('type') + "\n") file.write(" - " + style + "Type:" + style + " " + e.get('type') + "\n")
if (e.get('trigger')): if (e.get('trigger')):
file.write(" - Trigger: " + e.get('trigger') + "\n") file.write(" - " + style + "Trigger:" + style + " " + e.get('trigger') + "\n")
if str(e.tag) == 'match': if str(e.tag) == 'match':
file.write("* Match: \n") file.write("* " + style + "Match:" + style + " \n")
if (e.get('count')): if (e.get('count')):
file.write(" - Count: " + e.get('count') + "\n") file.write(" - " + style + "Count:" + style + " " + e.get('count') + "\n")
if (e.get('matchType')): if (e.get('matchType')):
file.write(" - Match Type: " + e.get('matchType') + "\n") file.write(" - " + style + "Match Type:" + style + " " + e.get('matchType') + "\n")
if str(e.tag) == 'matchFilter': if str(e.tag) == 'matchFilter':
file.write("* Match Filter: \n") file.write("* " + style + "Match Filter:" + style + " \n")
if (e.get('type')): if (e.get('type')):
file.write(" - Logical Element Type: " + e.get('type') + "\n") file.write(" - " + style + "Logical Element Type:" + style + " " + e.get('type') + "\n")
if str(e.tag) == 'singleFilterComponent': if str(e.tag) == 'singleFilterComponent':
if (e.get('type')): if (e.get('type')):
file.write(" - Filter Component \n - Type: " + e.get('type') + "\n") t = e.get('type')
if str(e.tag) == 'filterData': if str(e.tag) == 'filterData':
if (e.get('name') == "operator"): if (e.get('name') == "operator"):
file.write(" - Operator: " + e.get('value') + "\n") o = e.get('value')
if (e.get('name') == "value"): if (e.get('name') == "value"):
file.write(" - Value: " + e.get('value') + "\n") v = e.get('value')
if o and v and t:
file.write(" - " + style + "Filter Component" + style + " \n")
file.write(" - " + style + "Condition:" + style + " '" + t + "' " + o + " '" + v + "' \n")
file.write("******\n") file.write("******\n")
file.close() file.close()