intelmq.bots.experts.sieve package — intelmq 3.0.0.alpha.1 documentation

# intelmq.bots.experts.sieve package

## Submodules

## intelmq.bots.experts.sieve.expert module

SieveExpertBot filters and modifies events based on a specification language similar to mail sieve.

param file

  string

`intelmq.bots.experts.sieve.expert.` `BOT`

  alias of `intelmq.bots.experts.sieve.expert.SieveExpertBot`

class `intelmq.bots.experts.sieve.expert.` `Procedure`(value)

  Bases: `enum.Enum`

  An enumeration.

  `CONTINUE` = 1
  `DROP` = 3
  `KEEP` = 2

class `intelmq.bots.experts.sieve.expert.` `SieveExpertBot`(bot_id: str, start: bool = False, sighup_event=None, disable_multithreading: Optional[bool] = None)

  Bases: `intelmq.lib.bot.Bot`

  Filter and modify events based on a sieve-based language

  static `check`(parameters)

    The bot’s own check function can perform individual checks on it’s parameters. init() is not called before, this is a staticmethod which does not require class initialization.

    Parameters

      parameters – Bot’s parameters, defaults and runtime merged together

    Returns

      None or a list of [log_level, log_message] pairs, both

        strings. log_level must be a valid log level.

    Return type

      output

  `compute_basic_math`(action, event) → str
  `file`: str = '/opt/intelmq/var/lib/bots/sieve/filter.sieve'
  static `get_linecol`(model_obj, as_dict=False)

    Gets the position of a model object in the sieve file.

    Parameters

      - model_obj – the model object

      - as_dict – return the position as a dict instead of a tuple.

    Returns

      Returns the line and column number for the model object’s position in the sieve file. Default return type is a tuple of (line,col). Optionally, returns a dict when as_dict == True.

  `init`() → None
  static `init_metamodel`()
  `match_expression`(expr, event) → bool
  `process`() → None
  `process_action`(action, event) → intelmq.bots.experts.sieve.expert.Procedure
  `process_bool_match`(key, op, value, event)
  `process_branching`(rule, event) → intelmq.bots.experts.sieve.expert.Procedure
  `process_clause`(clause, event, else_clause=False) → Optional[intelmq.bots.experts.sieve.expert.Procedure]
  `process_condition`(cond, event) → bool
  `process_conjunction`(conj, event) → bool
  static `process_exist_match`(key, op, event) → bool
  `process_ip_range_match`(key, ip_range, event) → bool
  `process_list_match`(key, op, value, event) → bool
  `process_multi_numeric_match`(key, op, value, event) → bool
  `process_multi_string_match`(key, op, value, event) → bool
  `process_single_numeric_match`(key, op, value, event) → bool
  `process_single_string_match`(key, op, value, event) → bool
  `process_statement`(statement, event)
  static `read_sieve_file`(filename, metamodel)
  static `validate_ip_address`(ipaddr) → None
  static `validate_ip_range`(ip_range) → None
  static `validate_numeric_match`(num_match) → None

    Validates a numeric match expression.

    Checks if the event key (given on the left hand side of the expression) is of a valid type for a numeric match, according the the IntelMQ harmonization.

    Raises

      TextXSemanticError – when the key is of an incompatible type for numeric match expressions.

  static `validate_string_match`(str_match) → None

    Validates a string match expression.

    Checks if the type of the value given on the right hand side of the expression matches the event key in the left hand side, according to the IntelMQ harmonization.

    Raises

      TextXSemanticError – when the value is of incompatible type with the event key.

## intelmq.bots.experts.sieve.validator module

## Module contents