(self, params, field, event)
| 1216 | return self.sox_data |
| 1217 | |
| 1218 | def get_value(self, params, field, event): |
| 1219 | if field == 'message': |
| 1220 | message = '' |
| 1221 | if event['audit_event_type'] in syslog_templates: |
| 1222 | info = syslog_templates[event['audit_event_type']] |
| 1223 | while True: |
| 1224 | pattern = re.search(r'\${(\w+)}', info) |
| 1225 | if pattern: |
| 1226 | token = pattern[1] |
| 1227 | val = self.get_value(params, token, event) if field != token else None |
| 1228 | if val is None: |
| 1229 | logging.error('Event value is missing: %s', pattern[1]) |
| 1230 | val = '<missing>' |
| 1231 | |
| 1232 | sp = pattern.span() |
| 1233 | info = info[:sp[0]] + str(val) + info[sp[1]:] |
| 1234 | else: |
| 1235 | break |
| 1236 | message = info |
| 1237 | return message |
| 1238 | |
| 1239 | elif field in event: |
| 1240 | return event.get(field) |
| 1241 | |
| 1242 | elif field in audit_report.fields_to_uid_name: |
| 1243 | return self.resolve_lookup(params, field, event) |
| 1244 | return '' |
| 1245 | |
| 1246 | def resolve_lookup(self, params, field, event): |
| 1247 | lookup_type = audit_report.LookupType.lookup_type_from_field_name(field) |
no test coverage detected