(self)
return '\n'.join(output_strings)
Entry point for the analyzer.

        Returns:
            String with summary of the analyzer result.
Entry point for the analyzer.
Entry point for the analyzer .
def run(self):
        """Entry point for the analyzer.

        Returns:
            String with summary of the analyzer result.
        """

        tags_applied = {}
        sigma_rule_counter = 0
        tagged_events_counter = 0

        rule = self._rule
        if not rule:
            logger.error('No  Sigma rules found. Check SIGMA_RULES_FOLDERS')
        rule_name = rule.get('title', 'N/A')
        problem_strings = []
        output_strings = []

        tags_applied[rule.get('file_name')] = 0
        try:
            sigma_rule_counter += 1
            tagged_events_counter = self.run_sigma_rule(
                rule.get('es_query'), rule.get('file_name'),
                tag_list=rule.get('tags'))
            tags_applied[rule.get('file_name')] += tagged_events_counter
        except:  # pylint: disable=bare-except
            logger.error(
                'Problem with rule in file {0:s}: '.format(
                    rule.get('file_name')), exc_info=True)
            problem_strings.append('* {0:s}'.format(
                rule.get('file_name')))

        output_strings.append(
            f'{tagged_events_counter} events tagged for rule [{rule_name}]')

        if len(problem_strings) > 0:
            output_strings.append('Problematic rules:')
            output_strings.extend(problem_strings)

        return '\n'.join(output_strings)
def run ( self ) : tags_applied = { } sigma_rule_counter = 0 tagged_events_counter = 0 rule = self . _rule if not rule : logger . error ( 'No  Sigma rules found. Check SIGMA_RULES_FOLDERS' ) rule_name = rule . get ( 'title' , 'N/A' ) problem_strings = [ ] output_strings = [ ] tags_applied [ rule . get ( 'file_name' ) ] = 0 try : sigma_rule_counter += 1 tagged_events_counter = self . run_sigma_rule ( rule . get ( 'es_query' ) , rule . get ( 'file_name' ) , tag_list = rule . get ( 'tags' ) ) tags_applied [ rule . get ( 'file_name' ) ] += tagged_events_counter except : # pylint: disable=bare-except logger . error ( 'Problem with rule in file {0:s}: ' . format ( rule . get ( 'file_name' ) ) , exc_info = True ) problem_strings . append ( '* {0:s}' . format ( rule . get ( 'file_name' ) ) ) output_strings . append ( f'{tagged_events_counter} events tagged for rule [{rule_name}]' ) if len ( problem_strings ) > 0 : output_strings . append ( 'Problematic rules:' ) output_strings . extend ( problem_strings ) return '\n' . join ( output_strings )