valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Remove unused function

Browse Source
This commit is contained in:
Jonas Plum 2020-05-30 01:57:06 +02:00
parent 5cc82d0f05
commit 3a6ac5bd5c
3 changed files with 3 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@ -110,7 +110,7 @@ test-backend-es-qs:
test-backend-sql: test-backend-sql:
cd tools && python3 setup.py install cd tools && python3 setup.py install
cd tools && python3 -m pytest tests/test_backend_sql.py tests/test_backend_sqlite.py cd tools && $(COVERAGE) run -m pytest tests/test_backend_sql.py tests/test_backend_sqlite.py
test-sigma2attack: test-sigma2attack:
$(COVERAGE) run -a --include=$(COVSCOPE) tools/sigma2attack $(COVERAGE) run -a --include=$(COVSCOPE) tools/sigma2attack

2
tools/sigma/backends/sql.py
View File

@ -178,7 +178,7 @@ class SQLBackend(SingleTextQueryBackend):
def generateQuery(self, parsed): def generateQuery(self, parsed):
if self._recursiveFtsSearch(parsed.parsedSearch): if self._recursiveFtsSearch(parsed.parsedSearch):
raise NotImplementedError("FullTextSearch not implemented for SQL Backend, use SQLite Backend.") raise NotImplementedError("FullTextSearch not implemented for SQL Backend.")
result = self.generateNode(parsed.parsedSearch) result = self.generateNode(parsed.parsedSearch)
if parsed.parsedAgg: if parsed.parsedAgg:

19
tools/sigma/backends/sqlite.py
View File

@ -20,7 +20,7 @@ import re
class SQLiteBackend(SQLBackend): class SQLiteBackend(SQLBackend):
"""SQLiteBackend provides FullTextSearch functionality""" """Converts Sigma rule into SQL query for SQLite"""
identifier = "sqlite" identifier = "sqlite"
active = True active = True
@ -121,20 +121,3 @@ class SQLiteBackend(SQLBackend):
return "SELECT * FROM {} WHERE {}".format(fro, whe) return "SELECT * FROM {} WHERE {}".format(fro, whe)
return "SELECT * FROM {} WHERE {}".format(self.table, result) return "SELECT * FROM {} WHERE {}".format(self.table, result)
def generateFullTextQuery(self, search, parsed):
search = search.replace('"', '')
search = '" OR "'.join(search.split(" OR "))
search = '" AND "'.join(search.split(" AND "))
search = '"{}"'.format(search)
search = search.replace('%', '')
search = search.replace('_', '')
search = '{} MATCH (\'{}\')'.format(self.table, search)
if parsed.parsedAgg:
# Handle aggregation
fro, whe = self.generateAggregation(parsed.parsedAgg, search)
return "SELECT * FROM {} WHERE {}".format(fro, whe)
return 'SELECT * FROM {} WHERE {}'.format(self.table, search)