|
28 | 28 | classAnomaliFieldValueRender(SqlFieldValueRender): |
29 | 29 | details:PlatformDetails=anomali_query_details |
30 | 30 |
|
| 31 | +defcontains_modifier(self,field:str,value:DEFAULT_VALUE_TYPE)->str: |
| 32 | +ifisinstance(value,list): |
| 33 | +returnf"({self.or_token.join(self.contains_modifier(field=field,value=v)forvinvalue)})" |
| 34 | + |
| 35 | +value=f"'%{self._pre_process_value(field,value)}%'" |
| 36 | +returnf"{field} like{value}" |
| 37 | + |
| 38 | +defendswith_modifier(self,field:str,value:DEFAULT_VALUE_TYPE)->str: |
| 39 | +ifisinstance(value,list): |
| 40 | +returnf"({self.or_token.join(self.endswith_modifier(field=field,value=v)forvinvalue)})" |
| 41 | + |
| 42 | +value=f"'%{self._pre_process_value(field,value)}'" |
| 43 | +returnf"{field} like{value}" |
| 44 | + |
| 45 | +defstartswith_modifier(self,field:str,value:DEFAULT_VALUE_TYPE)->str: |
| 46 | +ifisinstance(value,list): |
| 47 | +returnf"({self.or_token.join(self.startswith_modifier(field=field,value=v)forvinvalue)})" |
| 48 | + |
| 49 | +value=f"'{self._pre_process_value(field,value)}%'" |
| 50 | +returnf"{field} like{value}" |
| 51 | + |
31 | 52 | defkeywords(self,field:str,value:DEFAULT_VALUE_TYPE)->str: |
32 | 53 | returnf'message contains "{self._pre_process_value(field,value)}"' |
33 | 54 |
|
|