(self)
return False, 'No hits discovered'
Returns a tuple with a bool on whether data was found and a message.

        Raises:
            RuntimeError: If the data finder cannot run.

        Returns:
            A tuple with two entries:
                bool: whether data was discovered or not.
                str: a message string indicating how the data was found or the
                    the reason why it wasn't.
Returns a tuple with a bool on whether data was found and a message.
Returns a tuple with a bool on whether data was found and a message .
def find_data(self):
        """Returns a tuple with a bool on whether data was found and a message.

        Raises:
            RuntimeError: If the data finder cannot run.

        Returns:
            A tuple with two entries:
                bool: whether data was discovered or not.
                str: a message string indicating how the data was found or the
                    the reason why it wasn't.
        """
        if not self.can_run():
            return False, 'Unable to run the data finder, missing information.'

        query_string = self._rule.get('query_string')
        query_dsl = self._rule.get('query_dsl')

        if not query_string and not query_dsl:
            raise RuntimeError(
                'Unable to run, missing either a query string or a DSL to '
                'perform the search.')

        attribute = self._rule.get('attribute')
        regular_expression = self._rule.get('regular_expression')
        if regular_expression:
            if not attribute:
                raise RuntimeError(
                    'Attribute must be set in a rule if a regular expression '
                    'is used.')
            expression = utils.compile_regular_expression(
                expression_string=regular_expression,
                expression_flags=self._rule.get('re_flags'),
                expression_parameters=self._rule.get('re_parameters'))
        else:
            expression = None

        query_filter = {
            'chips': [{
                'field': '',
                'type': 'datetime_range',
                'operator': 'must',
                'active': True,
                'value': f'{self._start_date},{self._end_date}',
            }]
        }

        event_generator = self._datastore.search_stream(
            query_string=query_string,
            query_dsl=query_dsl,
            query_filter=query_filter,
            indices=self._indices,
            return_fields=attribute,
            enable_scroll=True,
            timeline_ids=self._timeline_ids
        )

        for event in event_generator:
            # TODO: Save the result to the Investigation object when that
            # exist in the future.
            if not expression:
                return True, 'Data discovered'

            source = event.get('_source', {})
            value = source.get(attribute)
            if not value:
                logger.warning('Attribute: [{0:s}] is empty'.format(attribute))

            result = expression.findall(value)
            if not result:
                continue

            return True, 'Data discovered using Regular Expression'

        return False, 'No hits discovered'
def find_data ( self ) : if not self . can_run ( ) : return False , 'Unable to run the data finder, missing information.' query_string = self . _rule . get ( 'query_string' ) query_dsl = self . _rule . get ( 'query_dsl' ) if not query_string and not query_dsl : raise RuntimeError ( 'Unable to run, missing either a query string or a DSL to ' 'perform the search.' ) attribute = self . _rule . get ( 'attribute' ) regular_expression = self . _rule . get ( 'regular_expression' ) if regular_expression : if not attribute : raise RuntimeError ( 'Attribute must be set in a rule if a regular expression ' 'is used.' ) expression = utils . compile_regular_expression ( expression_string = regular_expression , expression_flags = self . _rule . get ( 're_flags' ) , expression_parameters = self . _rule . get ( 're_parameters' ) ) else : expression = None query_filter = { 'chips' : [ { 'field' : '' , 'type' : 'datetime_range' , 'operator' : 'must' , 'active' : True , 'value' : f'{self._start_date},{self._end_date}' , } ] } event_generator = self . _datastore . search_stream ( query_string = query_string , query_dsl = query_dsl , query_filter = query_filter , indices = self . _indices , return_fields = attribute , enable_scroll = True , timeline_ids = self . _timeline_ids ) for event in event_generator : # TODO: Save the result to the Investigation object when that # exist in the future. if not expression : return True , 'Data discovered' source = event . get ( '_source' , { } ) value = source . get ( attribute ) if not value : logger . warning ( 'Attribute: [{0:s}] is empty' . format ( attribute ) ) result = expression . findall ( value ) if not result : continue return True , 'Data discovered using Regular Expression' return False , 'No hits discovered'