def cc_function_call()

in geneve/events_emitter_eql.py [0:0]


def cc_function_call(node: eql.ast.FunctionCall, negate: bool, max_branches: int) -> Root:
    if type(node.arguments[0]) is not eql.ast.Field:
        raise NotImplementedError(f"Unsupported argument type: {type(node.arguments[0])}")
    args_types = (eql.ast.String, eql.ast.Number)
    if any(type(arg) not in args_types for arg in node.arguments[1:]):
        wrong_types = sorted({str(type(arg)) for arg in node.arguments[1:] if type(arg) not in args_types})
        raise NotImplementedError(f"Unsupported argument type(s): {', '.join(wrong_types)}")
    fn_name = node.name.lower()
    if fn_name == "wildcard":
        return cc_wildcard(node, negate, max_branches)
    elif fn_name == "cidrmatch":
        return cc_function(node, negate, max_branches, "in")
    elif fn_name == "_cardinality":
        return cc_function(node, negate, max_branches, "cardinality")
    else:
        raise NotImplementedError(f"Unsupported function: {node.name}")