class msiempy.FieldFilter(_QueryFilter): (source)
Query field filter
Based on EsmFieldFilter SIEM API object.
This class is automatically used when instanciating EventManager
objects. It automatically creates filters in the right dict
format from tuples passed to the filter argument of EventManager
:
>>> e = EventManager(time_range='LAST_MINUTE', filters=[ ('SrcIP', ['10.5.0.0/16']) ])
Default operator is "IN". To change the operator, create s custom FieldFilter
.
Exemple to filter by Signature ID:
>>> e = EventManager(time_range='LAST_24_HOURS', filters=[ FieldFilter('DSIDSigID', ["49190-4294967295"], operator='EQUALS') ])
EventManager.get_possible_filters
or use the provided script in the sample folderGroupFilter
Class Variable | DOCUMENTED_FILTERS | List fo documented filter names, show a warning if trying to filter on a unknown filter name |
Method | __init__ | Create a new field filter for a query. |
Instance Variable | operator | Filter operator. Throws AttributeError if trying to set an unknown operator. |
Instance Variable | values | List of values of the filter. |
Instance Variable | name | Name of the field |
Instance Variable | data | Undocumented |
Class Variable | POSSIBLE_OPERATORS | List of possibles operators |
Class Variable | POSSIBLE_VALUE_TYPES | List of possible value type. See add_value . |
Method | add_value | Add a new value to the filter. |
Method | add_basic_value | Wrapper arround add_value method to simply add a EsmBasicValue. |
Instance Variable | _operator | Undocumented |
Instance Variable | _values | Undocumented |
Method | _get_operator | Undocumented |
Method | _set_operator | Undocumented |
Method | _get_values | Undocumented |
Method | _set_values | Undocumented |
List[str]
)
Create a new field filter for a query.
name
(str
): field name as string. Field name property. Example : "SrcIP". See full list here: https://github.com/mfesiem/msiempy/blob/master/static/all_filters.jsonvalues
(list
): list of values the field is going to be tested againts with the specified orperator.orperator
(str
): One of: IN, NOT_IN, GREATER_THAN, LESS_THAN, GREATER_OR_EQUALS_THAN, LESS_OR_EQUALS_THAN, NUMERIC_EQUALS, NUMERIC_NOT_EQUALS, DOES_NOT_EQUAL, EQUALS, CONTAINS, DOES_NOT_CONTAIN, REGEXList of values of the filter.
Values will be added with:
Values will always be added to the filter. To remove values, handle directly the _values
property.
Example:
filter = FieldFilter(name='DstIP', values=[{'type':'EsmWatchlistValue', 'watchlist':42}], operator='IN')
Add a new value to the filter.
KeyError
or AttributeError
if you don't respect the correct type/key/value combo.