def __init__(self, *rule_paths):
RulesEngine._config = RulesEngine._config or load_config()
RulesEngine._threat_intel = (
RulesEngine._threat_intel or ThreatIntel.load_from_config(self.config)
)
# Instantiate the alert forwarder to handle sending alerts to the alert processor
RulesEngine._alert_forwarder = RulesEngine._alert_forwarder or AlertForwarder()
# Load the lookup tables
RulesEngine._lookup_tables = LookupTables.get_instance(config=self.config)
# If no rule import paths are specified, default to the config
rule_paths = rule_paths or [
item for location in {'rule_locations', 'matcher_locations'}
for item in self.config['global']['general'][location]
]
import_folders(*rule_paths)
self._rule_stat_tracker = RuleStatisticTracker(
'STREAMALERT_TRACK_RULE_STATS' in env,
'LAMBDA_RUNTIME_DIR' in env
)
self._required_outputs_set = resources.get_required_outputs()
self._load_rule_table(self.config)
def test_import_rules(mock_import):
"""Rule - Import Folders"""
import_folders('matchers', 'rules')
mock_import.assert_has_calls([
call('matchers.matchers'),
call('rules.example'),
call('rules.community.cloudtrail.critical_api')
],
any_order=True)
def __init__(self, table_name, *rule_import_paths):
"""Load the given table to be used for rule information updates
Args:
table_name (str): The name of the DynamoDB table from which to load
rule info
rule_import_paths (str): Variable number of paths to import rules
from. Useful for using this as a standalone class. Items for this
can be ommitted if instantiated from a caller that has already
loaded the rules files.
"""
self._table = boto3.resource('dynamodb').Table(table_name)
import_folders(*rule_import_paths)
self._remote_rule_info = None
def import_publishers(cls):
if not cls._is_imported:
config = load_config()
import_folders(
*config['global']['general'].get('publisher_locations', []))
cls._is_imported = True
def import_publishers(cls):
if not cls._is_imported:
import_folders(cls._PUBLISHERS_DIRECTORY)
cls._is_imported = True
def load_packs(cls, directories):
import_folders(*directories)