(self)
return f'Found {len(ip_addresses)} IP address(es).'
Entry point for the analyzer.

        Returns:
            String with summary of the analyzer result
Entry point for the analyzer.
Entry point for the analyzer .
def run(self):
        """Entry point for the analyzer.

        Returns:
            String with summary of the analyzer result
        """
        if self.GEOIP_CLIENT is None:
            return 'GeoIP Client not configured in analyzer'

        query = f'_exists_:({" OR ".join(self.IP_FIELDS)})'

        return_fields = self.IP_FIELDS.copy()

        events = self.event_stream(
            query_string=query,
            return_fields=return_fields
        )

        ip_addresses = defaultdict(lambda: defaultdict(list))

        for event in events:
            for ip_address_field in self.IP_FIELDS:
                ip_address = event.source.get(ip_address_field)
                if ip_address is None:
                    continue

                if isinstance(ip_address, str):
                    ip_address = [ip_address]

                for ip_addr in ip_address:
                    if not self._validate_ip(ip_addr):
                        logger.debug(f'Value {0} in {1} not valid.'.format(
                            ip_addr, ip_address_field))
                        continue
                    ip_addresses[ip_addr][ip_address_field].append(event)

        try:
            client = self.GEOIP_CLIENT()  # pylint: disable=E1102
        except GeoIPClientError as error:
            return f'GeoIP Client error - {error}'

        for ip_address, ip_address_fields in ip_addresses.items():
            response = client.ip2geo(ip_address)

            try:
                iso_code, latitude, longitude, country_name, city_name = \
                    response
            except ValueError:
                logging.error('GeoIP client must return 5 fields: '
                              '<iso_code, latitude, longitude, country_name, '
                              'city_name>. '
                              ' Number of fields returned: {0:d}'.format(
                                  len(response)))
                continue

            flag_emoji = emojis.get_emoji(f'FLAG_{iso_code}')

            if flag_emoji is None:
                logger.error(
                    'Invalid ISO code {0} encountered for IP {1}.'.format(
                        iso_code, ip_address))

            for ip_address_field, events in ip_address_fields.items():
                for event in events:

                    new_attributes = {}
                    if latitude and longitude:
                        new_attributes[
                            f'{ip_address_field}_latitude'] = latitude
                        new_attributes[
                            f'{ip_address_field}_longitude'] = longitude
                    if iso_code:
                        new_attributes[
                            f'{ip_address_field}_iso_code'] = iso_code
                    if city_name:
                        new_attributes[
                            f'{ip_address_field}_city'] = city_name
                    event.add_attributes(new_attributes)

                    if flag_emoji:
                        event.add_emojis([flag_emoji])

                    if country_name:
                        event.add_tags([country_name])
                    event.commit()

        return f'Found {len(ip_addresses)} IP address(es).'
def run ( self ) : if self . GEOIP_CLIENT is None : return 'GeoIP Client not configured in analyzer' query = f'_exists_:({" OR ".join(self.IP_FIELDS)})' return_fields = self . IP_FIELDS . copy ( ) events = self . event_stream ( query_string = query , return_fields = return_fields ) ip_addresses = defaultdict ( lambda : defaultdict ( list ) ) for event in events : for ip_address_field in self . IP_FIELDS : ip_address = event . source . get ( ip_address_field ) if ip_address is None : continue if isinstance ( ip_address , str ) : ip_address = [ ip_address ] for ip_addr in ip_address : if not self . _validate_ip ( ip_addr ) : logger . debug ( f'Value {0} in {1} not valid.' . format ( ip_addr , ip_address_field ) ) continue ip_addresses [ ip_addr ] [ ip_address_field ] . append ( event ) try : client = self . GEOIP_CLIENT ( ) # pylint: disable=E1102 except GeoIPClientError as error : return f'GeoIP Client error - {error}' for ip_address , ip_address_fields in ip_addresses . items ( ) : response = client . ip2geo ( ip_address ) try : iso_code , latitude , longitude , country_name , city_name = response except ValueError : logging . error ( 'GeoIP client must return 5 fields: ' '<iso_code, latitude, longitude, country_name, ' 'city_name>. ' ' Number of fields returned: {0:d}' . format ( len ( response ) ) ) continue flag_emoji = emojis . get_emoji ( f'FLAG_{iso_code}' ) if flag_emoji is None : logger . error ( 'Invalid ISO code {0} encountered for IP {1}.' . format ( iso_code , ip_address ) ) for ip_address_field , events in ip_address_fields . items ( ) : for event in events : new_attributes = { } if latitude and longitude : new_attributes [ f'{ip_address_field}_latitude' ] = latitude new_attributes [ f'{ip_address_field}_longitude' ] = longitude if iso_code : new_attributes [ f'{ip_address_field}_iso_code' ] = iso_code if city_name : new_attributes [ f'{ip_address_field}_city' ] = city_name event . add_attributes ( new_attributes ) if flag_emoji : event . add_emojis ( [ flag_emoji ] ) if country_name : event . add_tags ( [ country_name ] ) event . commit ( ) return f'Found {len(ip_addresses)} IP address(es).'