GREASE Source Detectors

Detectors are used to parse data from sourcing and determine if a job needs to be executed.

NOTE: If developing a new detector it is the accepted practice for all non-error log messages to be set to only print in verbose mode

Regex Detector

class tgt_grease.enterprise.Detectors.Regex(ioc=None)

Bases: tgt_grease.enterprise.Model.BaseDetector.Detector

Regular Expression Detector for GREASE Detection

A Typical Regex configuration looks like this:

{
    ...
    'logic': {
        'Regex': [
            {
                'field': String, # <-- Field to search for
                'pattern': String, # <-- Regex to perform on field
                'variable': Boolean, # <-- OPTIONAL, if true then create a context variable of result
                'variable_name: String # <-- REQUIRED IF variable, name of context variable
            }
            ...
        ]
        ...
    }
}
processObject(source, ruleConfig)

Processes an object and returns valid rule data

Data returned in the second parameter from this method should be in this form:

{
    '<field>': Object # <-- if specified as a variable then return the key->Value pairs
    ...
}
Parameters:
  • source (dict) – Source Data
  • ruleConfig (list[dict]) – Rule Configuration Data
Returns:

first element boolean for success; second dict for any fields returned as variables
Return type:

tuple

Exists Detector

class tgt_grease.enterprise.Detectors.Exists(ioc=None)

Bases: tgt_grease.enterprise.Model.BaseDetector.Detector

Field Existence Detector for GREASE Detection

A Typical Regex configuration looks like this:

{
    ...
    'logic': {
        'Exists': [
            {
                'field': String, # <-- Field to search for
                'variable': Boolean, # <-- OPTIONAL, if true then create a context variable of result
                'variable_name: String # <-- REQUIRED IF variable, name of context variable
            }
            ...
        ]
        ...
    }
}
processObject(source, ruleConfig)

Processes an object and returns valid rule data

Data returned in the second parameter from this method should be in this form:

{
    '<field>': Object # <-- if specified as a variable then return the key->Value pairs
    ...
}
Parameters:
  • source (dict) – Source Data
  • ruleConfig (list[dict]) – Rule Configuration Data
Returns:

first element boolean for success; second dict for any fields returned as variables
Return type:

tuple

Range Detector

class tgt_grease.enterprise.Detectors.Range(ioc=None)

Bases: tgt_grease.enterprise.Model.BaseDetector.Detector

Field Number Range Detector for GREASE Detection

A Typical Range configuration looks like this:

{
    ...
    'logic': {
        'Range': [
            {
                'field': String, # <-- Field to search for
                'min': Int/float, # <-- OPTIONAL IF max is set
                'max': Int/Float # <-- OPTIONAL IF min is set
            }
            ...
        ]
        ...
    }
}

Note

The min field is only required if max is not present. This would ensure the field is above the number provided

Note

The max field is only required if min is not present. This would ensure the field is below the number provided

Note

If both are provided then the field would need to be inside the range provided

Note

To find an exact number set min one below the target and max one above the target

processObject(source, ruleConfig)

Processes an object and returns valid rule data

Data returned in the second parameter from this method should be in this form:

{
    '<field>': Object # <-- if specified as a variable then return the key->Value pairs
    ...
}
Parameters:
  • source (dict) – Source Data
  • ruleConfig (list[dict]) – Rule Configuration Data
Returns:

first element boolean for success; second dict for any fields returned as variables
Return type:

tuple
range_compare(field, LogicalBlock)

Compares number range to a field

Parameters:
  • field (int/float/long) – field to compare
  • LogicalBlock (dict) – Logical Block
Returns:

if the range is successful then true else false
Return type:

bool

DateRange Detector

class tgt_grease.enterprise.Detectors.DateRange(ioc=None)

Bases: tgt_grease.enterprise.Model.BaseDetector.Detector

Date Range Detector for GREASE Detection

A Typical DateRange configuration looks like this:

{
    ...
    'logic': {
        'DateRange': [
            {
                'field': String, # <-- Field to search for
                'min': DateTime String, # <-- OPTIONAL IF max is set
                'max': DateTime String, # <-- OPTIONAL IF min is set
                'format': '%Y-%m-%d', # <-- Mandatory via strptime behavior
                'variable': Boolean, # <-- OPTIONAL, if true then create a context variable of result
                'variable_name: String # <-- REQUIRED IF variable, name of context variable
            }
            ...
        ]
        ...
    }
}

Note

The min field is only required if max is not present. This would ensure the field is after the date provided

Note

The max field is only required if min is not present. This would ensure the field is before the date provided

Note

Change the format to any supported https://docs.python.org/2/library/datetime.html#strftime-and-strptime-behavior

Note

To find an exact date/time set min one below the target and max one above the target

processObject(source, ruleConfig)

Processes an object and returns valid rule data

Data returned in the second parameter from this method should be in this form:

{
    '<field>': Object # <-- if specified as a variable then return the key->Value pairs
    ...
}
Parameters:
  • source (dict) – Source Data
  • ruleConfig (list[dict]) – Rule Configuration Data
Returns:

first element boolean for success; second dict for any fields returned as variables
Return type:

tuple
timeCompare(field, LogicalBlock)

Compares a date to a range

Parameters:
  • field (str) – field to compare
  • LogicalBlock (dict) – Logical Block
Returns:

if the range is successful then true else false
Return type:

bool

DateDelta Detector

class tgt_grease.enterprise.Detectors.DateDelta(ioc=None)

Bases: tgt_grease.enterprise.Model.BaseDetector.Detector

Date Delta Detector for GREASE Detection

This detector differs from DateRange as it is relative. In DateRange you can determine constant days whereas DateDelta can tell you how many days in the future or past a field is from the date either specified or the current date.

A Typical DateDelta configuration looks like this:

{
    ...
    'logic': {
        'DateDelta': [
            {
                'field': String, # <-- Field to search for
                'delta': String, # <-- timedelta key for delta range; Accepted Values: weeks, days, hours, minutes, seconds, milliseconds, microseconds,
                'delta_value': Int, # <-- numeric value for delta to be EX: 1 weeks
                'format': '%Y-%m-%d', # <-- Mandatory via strptime behavior
                'operator': String, # <-- Accepted Values: < <= > >= = !=
                'direction': String, # <-- Accepted Values: future past
                'date': String, # <-- OPTIONAL, if set then operation will be performed on this date compared to field
                'variable': Boolean, # <-- OPTIONAL, if true then create a context variable of result
                'variable_name: String # <-- REQUIRED IF variable, name of context variable
            }
            ...
        ]
        ...
    }
}

Note

Change the format to any supported https://docs.python.org/2/library/datetime.html#strftime-and-strptime-behavior

Note

If date field not provided will be assumed to be UTC Time

processObject(source, ruleConfig)

Processes an object and returns valid rule data

Data returned in the second parameter from this method should be in this form:

{
    '<field>': Object # <-- if specified as a variable then return the key->Value pairs
    ...
}
Parameters:
  • source (dict) – Source Data
  • ruleConfig (list[dict]) – Rule Configuration Data
Returns:

first element boolean for success; second dict for any fields returned as variables
Return type:

tuple
timeCompare(field, LogicalBlock)

Compares a date to find a delta

Parameters:
  • field (str) – field to compare
  • LogicalBlock (dict) – Logical Block
Returns:

if the range is successful then true else false
Return type:

bool