intelmq.bots.experts.sieve package

Submodules

intelmq.bots.experts.sieve.expert module

SieveExpertBot filters and modifies events based on a specification language similar to mail sieve.

param file:string
intelmq.bots.experts.sieve.expert.BOT

alias of intelmq.bots.experts.sieve.expert.SieveExpertBot

class intelmq.bots.experts.sieve.expert.Procedure

Bases: enum.Enum

An enumeration.

CONTINUE = 1
DROP = 3
KEEP = 2
class intelmq.bots.experts.sieve.expert.SieveExpertBot(bot_id: str, start: bool = False, sighup_event=None, disable_multithreading: bool = None)

Bases: intelmq.lib.bot.ExpertBot

Filter and modify events based on a sieve-based language

static check(parameters)
compute_basic_math(action, event) → str
file = '/opt/intelmq/var/lib/bots/sieve/filter.sieve'
static get_linecol(model_obj, as_dict=False)

Gets the position of a model object in the sieve file.

Parameters:
  • model_obj – the model object
  • as_dict – return the position as a dict instead of a tuple.
Returns:

Returns the line and column number for the model object’s position in the sieve file. Default return type is a tuple of (line,col). Optionally, returns a dict when as_dict == True.

init() → None
static init_metamodel()
match_expression(expr, event) → bool
process() → None
process_action(action, event) → intelmq.bots.experts.sieve.expert.Procedure
process_bool_match(key, op, value, event)
process_branching(rule, event) → intelmq.bots.experts.sieve.expert.Procedure
process_clause(clause, event, else_clause=False) → typing.Union[intelmq.bots.experts.sieve.expert.Procedure, NoneType]
process_condition(cond, event) → bool
process_conjunction(conj, event) → bool
static process_exist_match(key, op, event) → bool
process_ip_range_match(key, ip_range, event) → bool
process_list_match(key, op, value, event) → bool
process_multi_numeric_match(key, op, value, event) → bool
process_multi_string_match(key, op, value, event) → bool
process_single_numeric_match(key, op, value, event) → bool
process_single_string_match(key, op, value, event) → bool
process_statement(statement, event)
static read_sieve_file(filename, metamodel)
static validate_ip_address(ipaddr) → None
static validate_ip_range(ip_range) → None
static validate_numeric_match(num_match) → None

Validates a numeric match expression.

Checks if the event key (given on the left hand side of the expression) is of a valid type for a numeric match, according the the IntelMQ harmonization.

Raises:TextXSemanticError – when the key is of an incompatible type for numeric match expressions.
static validate_string_match(str_match) → None

Validates a string match expression.

Checks if the type of the value given on the right hand side of the expression matches the event key in the left hand side, according to the IntelMQ harmonization.

Raises:TextXSemanticError – when the value is of incompatible type with the event key.

Module contents