(self)
return '{0:d} events matched {1:d} indicators. [{2:s}]'.format(
            total_matches, len(matching_indicators), ', '.join(entities_found))
Entry point for the analyzer.

        Returns:
            String with summary of the analyzer result
Entry point for the analyzer.
Entry point for the analyzer .
def run(self):
        """Entry point for the analyzer.

        Returns:
            String with summary of the analyzer result
        """
        if not self.yeti_api_root or not self.yeti_api_key:
            return 'No Yeti configuration settings found, aborting.'

        self.get_indicators('x-regex')

        entities_found = set()

        events = self.event_stream(query_string='*',
                                   return_fields=['message'])
        total_matches = 0
        matching_indicators = set()
        for event in events:
            for _id, indicator in self.intel.items():
                regexp = indicator['compiled_regexp']
                if regexp.search(event.source['message']):
                    total_matches += 1
                    matching_indicators.add(indicator['id'])
                    neighbors = self.get_neighbors(indicator['id'])
                    self.mark_event(indicator, event, neighbors)
                    for n in neighbors:
                        entities_found.add('{0:s}:{1:s}'.format(
                            n['name'], n['type']
                        ))

        if not total_matches:
            return 'No indicators were found in the timeline.'

        for entity in entities_found:
            name, _type = entity.split(':')
            self.sketch.add_view(
                'Indicator matches for {0:s} ({1:s})'.format(name, _type),
                self.NAME,
                query_string='tag:"{0:s}"'.format(name))
        return '{0:d} events matched {1:d} indicators. [{2:s}]'.format(
            total_matches, len(matching_indicators), ', '.join(entities_found))
def run ( self ) : if not self . yeti_api_root or not self . yeti_api_key : return 'No Yeti configuration settings found, aborting.' self . get_indicators ( 'x-regex' ) entities_found = set ( ) events = self . event_stream ( query_string = '*' , return_fields = [ 'message' ] ) total_matches = 0 matching_indicators = set ( ) for event in events : for _id , indicator in self . intel . items ( ) : regexp = indicator [ 'compiled_regexp' ] if regexp . search ( event . source [ 'message' ] ) : total_matches += 1 matching_indicators . add ( indicator [ 'id' ] ) neighbors = self . get_neighbors ( indicator [ 'id' ] ) self . mark_event ( indicator , event , neighbors ) for n in neighbors : entities_found . add ( '{0:s}:{1:s}' . format ( n [ 'name' ] , n [ 'type' ] ) ) if not total_matches : return 'No indicators were found in the timeline.' for entity in entities_found : name , _type = entity . split ( ':' ) self . sketch . add_view ( 'Indicator matches for {0:s} ({1:s})' . format ( name , _type ) , self . NAME , query_string = 'tag:"{0:s}"' . format ( name ) ) return '{0:d} events matched {1:d} indicators. [{2:s}]' . format ( total_matches , len ( matching_indicators ) , ', ' . join ( entities_found ) )