Nov 9, 2023 · Nov 9, 2023
diff --git a/siem-converter/app/converter/backends/microsoft/siem_functions/aggregation.py b/siem-converter/app/converter/backends/microsoft/siem_functions/aggregation.py
diff --git a/siem-converter/app/converter/backends/microsoft/siem_functions/base.py b/siem-converter/app/converter/backends/microsoft/siem_functions/base.py
 from app.converter.backends.microsoft.siem_functions.aggregation import AlaAggregationFunctionRender
 from app.converter.backends.microsoft.siem_functions.search import AlaSearchFunctionRender
 from app.converter.backends.microsoft.siem_functions.sort import AlaSortFunctionRender
 from app.converter.backends.microsoft.siem_functions.table import AlaTableFunctionRender
 from app.converter.core.functions import Functions
 from app.converter.core.models.functions.aggregation import AggregationExpression
 from app.converter.core.models.functions.search import SearchExpression
 from app.converter.core.models.functions.sort import SortExpression
 from app.converter.core.models.functions.table import TableExpression
 from app.converter.core.models.functions.types import ParsedFunctions, NotSupportedFunction


 class MicroSoftQueryFunctions(Functions):

    render_functions_map = {
        SortExpression: AlaSortFunctionRender,
        SearchExpression: AlaSearchFunctionRender,
        AggregationExpression: AlaAggregationFunctionRender,
        TableExpression: AlaTableFunctionRender,
        # WhereExpression: AlaWhereFunctionRender
    }

    def render(self, functions: list):
        query = "| "
        funcs = []
        for function in functions:
            if render_class := self.render_functions_map.get(type(function)):
                funcs.append(render_class(function).render())
        query += " | ".join(funcs)
        query = query.rstrip(" ")
        return query

    def parse(self, query: str):
        result = []
        functions = query.split(self.function_delimiter)
diff --git a/siem-converter/app/converter/backends/microsoft/siem_functions/search.py b/siem-converter/app/converter/backends/microsoft/siem_functions/search.py
diff --git a/siem-converter/app/converter/backends/microsoft/siem_functions/sort.py b/siem-converter/app/converter/backends/microsoft/siem_functions/sort.py
diff --git a/siem-converter/app/converter/backends/microsoft/siem_functions/table.py b/siem-converter/app/converter/backends/microsoft/siem_functions/table.py
diff --git a/siem-converter/app/converter/backends/microsoft/siem_functions/where.py b/siem-converter/app/converter/backends/microsoft/siem_functions/where.py
Original file line number	Diff line number	Diff line change
		@@ -1,35 +1,9 @@
		from app.converter.backends.microsoft.siem_functions.aggregation import AlaAggregationFunctionRender
		from app.converter.backends.microsoft.siem_functions.search import AlaSearchFunctionRender
		from app.converter.backends.microsoft.siem_functions.sort import AlaSortFunctionRender
		from app.converter.backends.microsoft.siem_functions.table import AlaTableFunctionRender
		from app.converter.core.functions import Functions
		from app.converter.core.models.functions.aggregation import AggregationExpression
		from app.converter.core.models.functions.search import SearchExpression
		from app.converter.core.models.functions.sort import SortExpression
		from app.converter.core.models.functions.table import TableExpression
		from app.converter.core.models.functions.types import ParsedFunctions, NotSupportedFunction


		class MicroSoftQueryFunctions(Functions):

		render_functions_map = {
		SortExpression: AlaSortFunctionRender,
		SearchExpression: AlaSearchFunctionRender,
		AggregationExpression: AlaAggregationFunctionRender,
		TableExpression: AlaTableFunctionRender,
		# WhereExpression: AlaWhereFunctionRender
		}

		def render(self, functions: list):
		query = "\| "
		funcs = []
		for function in functions:
		if render_class := self.render_functions_map.get(type(function)):
		funcs.append(render_class(function).render())
		query += " \| ".join(funcs)
		query = query.rstrip(" ")
		return query

		def parse(self, query: str):
		result = []
		functions = query.split(self.function_delimiter)
Expand Down