def test_import_rules(mock_import):
"""Rule - Import Folders"""
rule.import_folders('rules', 'matchers')
mock_import.assert_has_calls([
call('matchers.matchers'),
call('rules.example'),
call('rules.community.cloudtrail.critical_api')
], any_order=True)
def __init__(self, config, *rule_paths):
"""Initialize a RulesEngine instance to cache a StreamThreatIntel instance."""
self._threat_intel = StreamThreatIntel.load_from_config(config)
self._required_outputs_set = resources.get_required_outputs()
import_folders(*rule_paths)
self._load_rule_table(config)
lookup_tables = LookupTables.load_lookup_tables(config)
if lookup_tables:
RulesEngine._LOOKUP_TABLES = lookup_tables.download_s3_objects()
def __init__(self, table_name, *rule_import_paths):
"""Load the given table to be used for rule information updates
Args:
rule_import_paths (string): Variable number of paths to import rules
from. Useful for using this as a standalone class. Items for this
can be ommitted if instantiated from a caller that has already
loaded the rules files.
"""
self._table = boto3.resource('dynamodb').Table(table_name)
import_folders(*rule_import_paths)
self._remote_rule_info = None
def __init__(self, *rule_paths):
RulesEngine._config = RulesEngine._config or load_config()
RulesEngine._threat_intel = (
RulesEngine._threat_intel or ThreatIntel.load_from_config(self.config)
)
# Instantiate the alert forwarder to handle sending alerts to the alert processor
RulesEngine._alert_forwarder = RulesEngine._alert_forwarder or AlertForwarder()
# Load the lookup tables, which include logic for refreshing the tables
RulesEngine._lookup_tables = LookupTables.load_lookup_tables(self.config)
# If not rule import paths are specified, default to the config
if not rule_paths:
rule_paths = [item for location in {'rule_locations', 'matcher_locations'}
for item in self.config['global']['general'][location]]
import_folders(*rule_paths)
self._in_lambda = 'LAMBDA_RUNTIME_DIR' in env
self._required_outputs_set = resources.get_required_outputs()
self._load_rule_table(self.config)
def __init__(self, config, *rule_paths):
"""Initialize a RulesEngine instance to cache a StreamThreatIntel instance."""
self._threat_intel = StreamThreatIntel.load_from_config(config)
self._required_outputs_set = resources.get_required_outputs()
import_folders(*rule_paths)
self._load_rule_table(config)