1616limitations under the License.
1717-----------------------------------------------------------------
1818"""
19+ import copy
20+ import json
21+ from typing import Optional
22+ from app .translator .core .mapping import SourceMapping
1923from app .translator .core .models .platform_details import PlatformDetails
24+ from app .translator .core .models .query_container import MetaInfoContainer
2025from app .translator .managers import render_manager
2126from app .translator .core .render import PlatformQueryRender
2227
23- from app .translator .platforms .sumo_logic .const import sumologic_search_query_details
28+ from app .translator .platforms .sumo_logic .const import (
29+ SEVERITY_MAP ,
30+ sumologic_cse_query_details ,
31+ sumologic_cse_rule_details ,
32+ DEFAULT_SUMOLOGIC_CSE_RULE
33+ )
2434from app .translator .platforms .sumo_logic .mapping import SumoLogicMappings ,sumologic_mappings
2535from app .translator .platforms .sumo_logic .renders .sumologic import SumologicFieldValue
2636
2737
2838
2939@render_manager .register
3040class SumologicCSERender (PlatformQueryRender ):
31- details :PlatformDetails = sumologic_search_query_details
41+ details :PlatformDetails = sumologic_cse_query_details
3242mappings :SumoLogicMappings = sumologic_mappings
3343
3444or_token = "OR"
@@ -41,12 +51,36 @@ class SumologicCSERender(PlatformQueryRender):
4151
4252@render_manager .register
4353class SumologicCSERuleRender (PlatformQueryRender ):
44- details :PlatformDetails = sumologic_search_query_details
54+ details :PlatformDetails = sumologic_cse_rule_details
4555mappings :SumoLogicMappings = sumologic_mappings
4656
4757or_token = "OR"
4858and_token = "AND"
4959not_token = "NOT"
5060
5161field_value_map = SumologicFieldValue (or_token = or_token )
52- query_pattern = "{prefix} {query} {functions}"
62+ query_pattern = "{prefix} {query} {functions}"
63+
64+
65+ def finalize_query (
66+ self ,
67+ prefix :str ,
68+ query :str ,
69+ functions :str ,
70+ meta_info :Optional [MetaInfoContainer ]= None ,
71+ source_mapping :Optional [SourceMapping ]= None ,# noqa: ARG002
72+ not_supported_functions :Optional [list ]= None ,
73+ * args ,# noqa: ARG002
74+ ** kwargs ,# noqa: ARG002
75+ )-> str :
76+ query = super ().finalize_query (prefix = prefix ,query = query ,functions = functions )
77+ rule = copy .deepcopy (DEFAULT_SUMOLOGIC_CSE_RULE )
78+ rule ["name" ]= meta_info .title or rule ["name" ]if meta_info else rule ['name' ]
79+ rule ["description" ]= meta_info .description or rule ["description" ]if meta_info else rule ['description' ]
80+ rule ["score" ]= SEVERITY_MAP .get (meta_info .severity )if meta_info else SEVERITY_MAP ['medium' ]
81+ rule ["expression" ]= query
82+ rule_str = json .dumps (rule ,indent = 4 ,sort_keys = False ,ensure_ascii = False )
83+ if not_supported_functions :
84+ rendered_not_supported = self .render_not_supported_functions (not_supported_functions )
85+ return rule_str + rendered_not_supported
86+ return rule_str