A detection rule object with support for data and text files.
| 2261 | |
| 2262 | @attr.s(slots=True) |
| 2263 | class Rule(BasicRule): |
| 2264 | """ |
| 2265 | A detection rule object with support for data and text files. |
| 2266 | """ |
| 2267 | |
| 2268 | def __attrs_post_init__(self, *args, **kwargs): |
| 2269 | self.setup() |
| 2270 | |
| 2271 | @classmethod |
| 2272 | def from_file(cls, rule_file, is_builtin=True): |
| 2273 | """ |
| 2274 | Return a new Rule object loaded from a file stored at |
| 2275 | ``rule_file`` with the text and it's data as with YAML frontmatter. |
| 2276 | """ |
| 2277 | rule = Rule(is_builtin=is_builtin) |
| 2278 | rule.load_data(rule_file=rule_file) |
| 2279 | return rule |
| 2280 | |
| 2281 | @property |
| 2282 | def pysafe_expression(self): |
| 2283 | """ |
| 2284 | Return a python safe identifier, for use in rule identifiers""" |
| 2285 | return python_safe_name(self.license_expression) |
| 2286 | |
| 2287 | def load_data(self, rule_file): |
| 2288 | """ |
| 2289 | Load data from ``rule_file`` which has both the text and the data (as YAML forntmatter). |
| 2290 | Check presence of text file to determine if this is a special synthetic rule. |
| 2291 | """ |
| 2292 | if self.is_synthetic: |
| 2293 | if not self.text: |
| 2294 | raise InvalidRule( |
| 2295 | f'Invalid synthetic rule without text: {self}: {self.text!r}') |
| 2296 | return self |
| 2297 | |
| 2298 | if not rule_file: |
| 2299 | raise InvalidRule( |
| 2300 | f'Cannot load rule without its corresponding rule_file: ' |
| 2301 | f'{self}: file://{rule_file}') |
| 2302 | |
| 2303 | self.identifier = file_name(rule_file) |
| 2304 | |
| 2305 | try: |
| 2306 | self.load(rule_file=rule_file) |
| 2307 | except Exception: |
| 2308 | trace = traceback.format_exc() |
| 2309 | raise InvalidRule(f'While loading: file://{rule_file}\n{trace}') |
| 2310 | |
| 2311 | return self |
| 2312 | |
| 2313 | def tokens(self): |
| 2314 | """ |
| 2315 | Return a sequence of token strings for this rule text. |
| 2316 | |
| 2317 | SIDE EFFECT: Computed attributes such as "length", "relevance", |
| 2318 | "is_continuous", "minimum_coverage" and "stopword_by_pos" are |
| 2319 | recomputed as a side effect. |
| 2320 | """ |
no outgoing calls