|
| 1 | +""" |
| 2 | +Uncoder IO Community Edition License |
| 3 | +----------------------------------------------------------------- |
| 4 | +Copyright (c) 2024 SOC Prime, Inc. |
| 5 | +
|
| 6 | +Licensed under the Apache License, Version 2.0 (the "License"); |
| 7 | +you may not use this file except in compliance with the License. |
| 8 | +You may obtain a copy of the License at |
| 9 | +
|
| 10 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 11 | +
|
| 12 | +Unless required by applicable law or agreed to in writing, software |
| 13 | +distributed under the License is distributed on an "AS IS" BASIS, |
| 14 | +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 15 | +See the License for the specific language governing permissions and |
| 16 | +limitations under the License. |
| 17 | +----------------------------------------------------------------- |
| 18 | +""" |
| 19 | +from app.translator.const import DEFAULT_VALUE_TYPE |
| 20 | +from app.translator.core.custom_types.values import ValueType |
| 21 | +from app.translator.core.models.platform_details import PlatformDetails |
| 22 | +from app.translator.core.render import BaseFieldValueRender, PlatformQueryRender |
| 23 | +from app.translator.managers import render_manager |
| 24 | +from app.translator.platforms.anomali.const import anomali_query_details |
| 25 | +from app.translator.platforms.anomali.mapping import AnomaliMappings, anomali_query_mappings |
| 26 | +from app.translator.platforms.base.sql.str_value_manager import sql_str_value_manager |
| 27 | + |
| 28 | + |
| 29 | +class AnomaliFieldValueRender(BaseFieldValueRender): |
| 30 | + details: PlatformDetails = anomali_query_details |
| 31 | + str_value_manager = sql_str_value_manager |
| 32 | + |
| 33 | + @staticmethod |
| 34 | + def _wrap_str_value(value: str) -> str: |
| 35 | + return f"'{value}'" |
| 36 | + |
| 37 | + def equal_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: |
| 38 | + if isinstance(value, list): |
| 39 | + return f"({self.or_token.join([self.equal_modifier(field=field, value=v) for v in value])})" |
| 40 | + return f"{field} = {self._pre_process_value(field, value, wrap_str=True)}" |
| 41 | + |
| 42 | + def not_equal_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: |
| 43 | + if isinstance(value, list): |
| 44 | + return f"({self.or_token.join([self.not_equal_modifier(field=field, value=v) for v in value])})" |
| 45 | + return f"{field} != {self._pre_process_value(field, value, wrap_str=True)}" |
| 46 | + |
| 47 | + def less_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: |
| 48 | + return f"{field} < {self._pre_process_value(field, value, wrap_str=True)}" |
| 49 | + |
| 50 | + def less_or_equal_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: |
| 51 | + return f"{field} <= {self._pre_process_value(field, value, wrap_str=True)}" |
| 52 | + |
| 53 | + def greater_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: |
| 54 | + return f"{field} > {self._pre_process_value(field, value, wrap_str=True)}" |
| 55 | + |
| 56 | + def greater_or_equal_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: |
| 57 | + return f"{field} >= {self._pre_process_value(field, value, wrap_str=True)}" |
| 58 | + |
| 59 | + def contains_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: |
| 60 | + if isinstance(value, list): |
| 61 | + return f"({self.or_token.join(self.contains_modifier(field=field, value=v) for v in value)})" |
| 62 | + return f"{field} like '%{self._pre_process_value(field, value)}%'" |
| 63 | + |
| 64 | + def endswith_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: |
| 65 | + if isinstance(value, list): |
| 66 | + return f"({self.or_token.join(self.endswith_modifier(field=field, value=v) for v in value)})" |
| 67 | + return f"{field} like '%{self._pre_process_value(field, value)}'" |
| 68 | + |
| 69 | + def startswith_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: |
| 70 | + if isinstance(value, list): |
| 71 | + return f"({self.or_token.join(self.startswith_modifier(field=field, value=v) for v in value)})" |
| 72 | + return f"{field} like '{self._pre_process_value(field, value)}%'" |
| 73 | + |
| 74 | + def regex_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: |
| 75 | + if isinstance(value, list): |
| 76 | + return f"({self.or_token.join(self.regex_modifier(field=field, value=v) for v in value)})" |
| 77 | + regex_str = self._pre_process_value(field, value, value_type=ValueType.regex_value, wrap_str=True) |
| 78 | + return f"regexp_like({field}, {regex_str})" |
| 79 | + |
| 80 | + def keywords(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: |
| 81 | + return f'message contains "{self._pre_process_value(field, value)}"' |
| 82 | + |
| 83 | + |
| 84 | +@render_manager.register |
| 85 | +class AnomaliQueryRender(PlatformQueryRender): |
| 86 | + details: PlatformDetails = anomali_query_details |
| 87 | + mappings: AnomaliMappings = anomali_query_mappings |
| 88 | + |
| 89 | + or_token = "OR" |
| 90 | + and_token = "AND" |
| 91 | + not_token = "NOT" |
| 92 | + |
| 93 | + comment_symbol = "--" |
| 94 | + is_single_line_comment = True |
| 95 | + |
| 96 | + field_value_render = AnomaliFieldValueRender(or_token=or_token) |
| 97 | + |
| 98 | + @staticmethod |
| 99 | + def _finalize_search_query(query: str) -> str: |
| 100 | + return f"| where {query}" if query else "" |
0 commit comments