(self, query, rule_name, tag_list=None)
return tagged_events_counter
Runs a sigma rule and applies the appropriate tags.

        Args:
            query: OpenSearch search query for events to tag.
            rule_name: rule_name to apply to matching events.
            tag_list: a list of additional tags to be added to the event(s)

        Returns:
            int: number of events tagged.
Runs a sigma rule and applies the appropriate tags.
Runs a sigma rule and applies the appropriate tags .
def run_sigma_rule(self, query, rule_name, tag_list=None):
        """Runs a sigma rule and applies the appropriate tags.

        Args:
            query: OpenSearch search query for events to tag.
            rule_name: rule_name to apply to matching events.
            tag_list: a list of additional tags to be added to the event(s)

        Returns:
            int: number of events tagged.
        """
        if not tag_list:
            tag_list = []
        return_fields = []
        tagged_events_counter = 0
        events = self.event_stream(
            query_string=query, return_fields=return_fields)
        for event in events:
            ts_sigma_rules = event.source.get('ts_sigma_rule', [])
            ts_sigma_rules.append(rule_name)
            event.add_attributes({'ts_sigma_rule': list(set(ts_sigma_rules))})
            ts_ttp = event.source.get('ts_ttp', [])
            special_tags = []
            for tag in tag_list:
                # Special handling for sigma tags that TS considers TTPS
                # https://car.mitre.org and https://attack.mitre.org
                if tag.startswith(('attack.', 'car.')):
                    ts_ttp.append(tag)
                    special_tags.append(tag)
            # ad the remaining tags as plain tags
            tags_to_add = list(set(tag_list) - set(special_tags))
            event.add_tags(tags_to_add)
            if len(ts_ttp) > 0:
                event.add_attributes({'ts_ttp': list(set(ts_ttp))})
            event.commit()
            tagged_events_counter += 1
        return tagged_events_counter
def run_sigma_rule ( self , query , rule_name , tag_list = None ) : if not tag_list : tag_list = [ ] return_fields = [ ] tagged_events_counter = 0 events = self . event_stream ( query_string = query , return_fields = return_fields ) for event in events : ts_sigma_rules = event . source . get ( 'ts_sigma_rule' , [ ] ) ts_sigma_rules . append ( rule_name ) event . add_attributes ( { 'ts_sigma_rule' : list ( set ( ts_sigma_rules ) ) } ) ts_ttp = event . source . get ( 'ts_ttp' , [ ] ) special_tags = [ ] for tag in tag_list : # Special handling for sigma tags that TS considers TTPS # https://car.mitre.org and https://attack.mitre.org if tag . startswith ( ( 'attack.' , 'car.' ) ) : ts_ttp . append ( tag ) special_tags . append ( tag ) # ad the remaining tags as plain tags tags_to_add = list ( set ( tag_list ) - set ( special_tags ) ) event . add_tags ( tags_to_add ) if len ( ts_ttp ) > 0 : event . add_attributes ( { 'ts_ttp' : list ( set ( ts_ttp ) ) } ) event . commit ( ) tagged_events_counter += 1 return tagged_events_counter