in aristotle/aristotle.py [0:0]
def __init__(self, rules, metadata_filter=None, enable_all_rules=False, summary_max=16, output_disabled_rules=False, ignore_classtype_keyword=False,
ignore_filename=False, normalize=False, enhance=False, modify_metadata=False, pfmod_file=None):
"""Constructor."""
# dict keys are sids
self.metadata_dict = {}
# dict keys are keys from metadata key-value pairs
self.keys_dict = {'sid': {}}
# dict keys are hash of key-value pairs from passed in filter string/file
self.metadata_map = {}
self.enable_all_rules = enable_all_rules
self.output_disabled_rules = output_disabled_rules
self.ignore_classtype_keyword = ignore_classtype_keyword
self.ignore_filename = ignore_filename
self.normalize = normalize
self.enhance = enhance
self.modify_metadata = modify_metadata
self.pfmod_file = pfmod_file
if pfmod_file and not modify_metadata:
print_warning("'pfmod_file' specified but 'modify_metadata' not enabled. Enabling 'modify_metadata'....")
self.modify_metadata = True
if not metadata_filter:
self.metadata_filter = None
print_debug("No metadata_filter given to Ruleset() constructor")
else:
self.set_metadata_filter(metadata_filter)
try:
self.summary_max = int(summary_max)
except Exception as e:
print_error("Unable to process 'summary_max' value '{}' passed to Ruleset constructor:\n{}".format(summary_max, e))
# deal with rules file(s)
try:
if os.path.isfile(rules):
with open(rules, 'r') as fh:
self.parse_rules(rules=fh.read(), filename=os.path.basename(rules))
elif os.path.isdir(rules):
# process all files ending with ".rules"; sort (alphabetically) and process in order
rules_files = sorted(glob.glob(os.path.join(rules, "*.rules")))
if len(rules_files) == 0:
print_error("No '.rules' files found in directory '{}'.".format(rules), fatal=True)
for file in rules_files:
if os.path.isfile(file):
with open(file, 'r') as fh:
self.parse_rules(rules=fh.read(), filename=os.path.basename(file))
else:
print_debug("File '{}' not a file! Skipping.".format(file))
else:
if len(rules) < 256 and "metadata" not in rules:
# probably a mis-typed filename
print_error("'{}' is not a valid file or directory, and does not appear to be a string containing valid rule(s)".format(rules), fatal=True)
self.parse_rules(rules)
if self.enhance:
self._enhance_metadata()
print_debug("Total cache size: {}".format(len(ipval_cache.keys())))
except Exception as e:
traceback.print_exc(e)
print_error("Unable to process rules '{}':\n{}".format(rules, e), fatal=True)