Method get_rules_json

valhallaAPI/valhalla.py:190–232

Retrieve the rules as JSON object :param product: set a certain product that all rules must support :param max_version: set a maximum YARA version that your product supports :param modules: set a list of modules that your product supports :param with_crypto:

(self, product="", max_version="", modules=[], with_crypto=True, tags=[], score=0, search="")

        return json.loads(r.text)

    def get_rules_json(self, product="", max_version="", modules=[], with_crypto=True, tags=[], score=0, search=""):
        """
        Retrieve the rules as JSON object
        :param product: set a certain product that all rules must support
        :param max_version: set a maximum YARA version that your product supports
        :param modules: set a list of modules that your product supports
        :param with_crypto: set False if a product's YARA has not been built with OpenSSL (--without-crypto)
        :param tags: set a list of tags that you want to retrieve
        :param score: minimum score for rules to include in the output
        :return:
        """
        # API Request
        r = requests.post("%s/api/%s/get" % (self.base_url, self.api_version),
                          data={
                              "apikey": self.api_key,
                              "format": "json",
                          },
                          proxies=self.proxies,
                          headers=self.headers)
        # Load JSON
        rules_response = json.loads(r.text)

        # Filter ------------------------------------------------------
        # Product filtering
        if product:
            (max_version, modules, with_crypto) = get_product_requirements(product=product)
        # Tag filtering
        if len(tags) > 0:
            rules_response['rules'] = filter_tags(rules_response['rules'], tags=tags)
        # Score
        if score > 0:
            rules_response['rules'] = filter_score(rules_response['rules'], minimum_score=score)
        # Search string
        if search:
            rules_response['rules'] = filter_search(rules_response['rules'], query=search)
        # Custom filtering
        if max_version or len(modules) > 0 or with_crypto is not True:
            rules_response['rules'] = filter_requirements(rules_response['rules'],
                                                          sup_ver_string=max_version,
                                                          sup_modules=modules,
                                                          with_crypto=with_crypto)
        # Return filtered set
        return rules_response

    def get_rules_text(self, product="", max_version="", modules=[], with_crypto=True, tags=[], score=0, search=""):
        """