Examples with VariableResolver org.apache.metron.stellar.dsl.VariableResolver used on opensource projects

Example 6 with VariableResolver

use of org.apache.metron.stellar.dsl.VariableResolver in project metron by apache.

the class QueryPcapFilter method test.

@Override
public boolean test(PacketInfo input) {
    Map<String, Object> fields = packetToFields(input);
    VariableResolver resolver = new MapVariableResolver(fields);
    return predicateProcessor.parse(queryString, resolver, StellarFunctions.FUNCTION_RESOLVER(), Context.EMPTY_CONTEXT());
}

Example 7 with VariableResolver

use of org.apache.metron.stellar.dsl.VariableResolver in project metron by apache.

the class ThreatTriageProcessor method apply.

@Nullable
@Override
public ThreatScore apply(@Nullable Map input) {
    ThreatScore threatScore = new ThreatScore();
    StellarPredicateProcessor predicateProcessor = new StellarPredicateProcessor();
    StellarProcessor processor = new StellarProcessor();
    VariableResolver resolver = new MapVariableResolver(input, sensorConfig.getConfiguration(), threatIntelConfig.getConfig());
    // attempt to apply each rule to the threat
    for (RiskLevelRule rule : threatTriageConfig.getRiskLevelRules()) {
        if (predicateProcessor.parse(rule.getRule(), resolver, functionResolver, context)) {
            // add the rule's score to the overall threat score
            String reason = execute(rule.getReason(), processor, resolver, String.class);
            RuleScore score = new RuleScore(rule, reason);
            threatScore.addRuleScore(score);
        }
    }
    // calculate the aggregate threat score
    Aggregators aggregators = threatTriageConfig.getAggregator();
    List<Number> allScores = threatScore.getRuleScores().stream().map(score -> score.getRule().getScore()).collect(Collectors.toList());
    Double aggregateScore = aggregators.aggregate(allScores, threatTriageConfig.getAggregationConfig());
    threatScore.setScore(aggregateScore);
    return threatScore;
}

Example 8 with VariableResolver

use of org.apache.metron.stellar.dsl.VariableResolver in project metron by apache.

the class DefaultStellarShellExecutor method executeStellar.

/**
 * Executes Stellar expressions.
 * @param expression The expression to execute.
 */
private StellarResult executeStellar(String expression) {
    StellarResult result;
    try {
        // execute the stellar expression
        VariableResolver variableResolver = new MapVariableResolver(getVariables());
        Object exprResult = new StellarProcessor().parse(expression, variableResolver, functionResolver, context);
        result = success(exprResult);
    } catch (Throwable t) {
        result = error(t);
    }
    return result;
}