def detection_rule(self, dr_path):
"""Desc"""
print("Populating Detection Rules..")
if dr_path:
dr_list = glob.glob(dr_path + '*.yml')
else:
dr_dirs = ATCconfig.get('detection_rules_directories')
# check if config provides multiple directories for detection rules
if isinstance(dr_dirs, list):
dr_list = []
for directory in dr_dirs:
dr_list += glob.glob(directory + '/*.yml')
elif isinstance(dr_dirs, str):
dr_list = glob.glob(dr_dirs + '/*.yml')
for dr_file in dr_list:
try:
dr = DetectionRule(dr_file,
apipath=self.apipath,
auth=self.auth,
space=self.space)
dr.render_template("confluence")
confluence_data = {
"title":
dr.fields['title'],
"spacekey":
self.space,
"parentid":
str(
ATCutils.confluence_get_page_id(
self.apipath, self.auth, self.space,
"Detection Rules")),
"confluencecontent":
dr.content,
}
res = ATCutils.push_to_confluence(confluence_data,
self.apipath, self.auth)
if res == 'Page updated':
print("==> updated page: DR '" + dr.fields['title'] +
"' (" + dr_file + ")")
# print("Done: ", dr.fields['title'])
except Exception as err:
print(dr_file + " failed")
print("Err message: %s" % err)
print('-' * 60)
traceback.print_exc(file=sys.stdout)
print('-' * 60)
print("Detection Rules populated!")
def detection_rule(self, dr_path):
"""Desc"""
print("Populating Detection Rules..")
if dr_path:
dr_list = glob.glob(dr_path + '*.yml')
else:
dr_list = glob.glob(
ATCconfig.get('detection_rules_directory') + '/*.yml')
for dr_file in dr_list:
try:
dr = DetectionRule(dr_file,
apipath=self.apipath,
auth=self.auth,
space=self.space)
dr.render_template("confluence")
confluence_data = {
"title":
dr.fields['title'],
"spacekey":
self.space,
"parentid":
str(
ATCutils.confluence_get_page_id(
self.apipath, self.auth, self.space,
"Detection Rules")),
"confluencecontent":
dr.content,
}
ATCutils.push_to_confluence(confluence_data, self.apipath,
self.auth)
print("Done: ", dr.fields['title'])
except Exception as err:
print(dr_file + " failed")
print("Err message: %s" % err)
print('-' * 60)
traceback.print_exc(file=sys.stdout)
print('-' * 60)
print("Detection Rules populated!")
def detection_rule(self, dr_path):
"""Populate Detection Rules"""
print("Populating Detection Rules..")
if dr_path:
dr_list = glob.glob(dr_path + '*.yml')
else:
dr_dirs = ATCconfig.get('detection_rules_directories')
# check if config provides multiple directories for detection rules
if isinstance(dr_dirs, list):
dr_list = []
for directory in dr_dirs:
dr_list += glob.glob(directory + '/*.yml')
elif isinstance(dr_dirs, str):
dr_list = glob.glob(dr_dirs + '/*.yml')
for dr_file in dr_list:
try:
dr = DetectionRule(dr_file)
dr.render_template("markdown")
dr.save_markdown_file(atc_dir=self.atc_dir)
except Exception as e:
print(dr_file + " failed\n\n%s\n\n" % e)
print("Err message: %s" % e)
print('-' * 60)
traceback.print_exc(file=sys.stdout)
print('-' * 60)
print("Detection Rules populated!")
def detection_rule(self, dr_path):
"""Desc"""
if dr_path:
dr_list = glob.glob(dr_path + '*.yml')
else:
dr_list = glob.glob(
ATCconfig.get('detection_rules_directory') + '/*.yml')
for dr_file in dr_list:
try:
dr = DetectionRule(dr_file)
dr.render_template("markdown")
dr.save_markdown_file(atc_dir=self.atc_dir)
except Exception as e:
print(dr_file + " failed\n\n%s\n\n" % e)
print("Err message: %s" % e)
print('-' * 60)
traceback.print_exc(file=sys.stdout)
print('-' * 60)