valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Implemented resolve_fieldname in FieldMappingChain

Browse Source
This commit is contained in:
Thomas Patzke 2018-09-13 14:56:31 +02:00
parent 2330306db1
commit 41a8ef2fd9
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
tools/sigma/config/mapping.py
View File

@ -190,3 +190,21 @@ class FieldMappingChain(object):
elif isinstance(mapping, SimpleFieldMapping):
cond.add(mapping.resolve(key, value, sigmaparser))
return cond
def resolve_fieldname(self, fieldname):
if type(self.fieldmappings) == str: # one field mapping
return self.fieldmappings
elif isinstance(self.fieldmappings, SimpleFieldMapping):
return self.fieldmappings.resolve_fieldname(fieldname)
elif type(self.fieldmappings) == set:
mappings = set()
for mapping in self.fieldmappings:
if type(mapping) == str:
mappings.add(mapping)
elif isinstance(mapping, SimpleFieldMapping):
resolved_mapping = mapping.resolve_fieldname(fieldname)
try:
mappings.update(iter(resolved_mapping))
except TypeError:
mappings.add(resolved_mapping)
return list(mappings)