Skip to content

Commit

Permalink
Query postprocessing and finalization
Browse files Browse the repository at this point in the history
  • Loading branch information
thomaspatzke committed Aug 5, 2023
1 parent ebea0ac commit b048fec
Showing 1 changed file with 12 additions and 1 deletion.
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
from sigma.pipelines.common import logsource_windows, windows_logsource_mapping
from sigma.processing.transformations import AddConditionTransformation, FieldMappingTransformation, DetectionItemFailureTransformation, RuleFailureTransformation, SetStateTransformation
from sigma.processing.postprocessing import EmbedQueryTransformation
from sigma.processing.conditions import LogsourceCondition, IncludeFieldCondition, ExcludeFieldCondition, RuleProcessingItemAppliedCondition
from sigma.processing.pipeline import ProcessingItem, ProcessingPipeline
from sigma.processing.pipeline import ProcessingItem, ProcessingPipeline, QueryPostprocessingItem

# TODO: the following code is just an example extend/adapt as required.
# See https://sigmahq-pysigma.readthedocs.io/en/latest/Processing_Pipelines.html for further documentation.
Expand All @@ -26,4 +27,14 @@ def {{ cookiecutter.backend_package_name }}_pipeline() -> ProcessingPipeline:
})
)
],
postprocessing_items=[
QueryPostprocessingItem(
transformation=EmbedQueryTransformation(prefix="...", suffix="..."),
rule_condition_linking=any,
rule_conditions=[
],
identifier="example",
)
],
finalizers=[ConcatenateQueriesFinalizer()],
)

0 comments on commit b048fec

Please sign in to comment.