File size: 3,033 Bytes
7c89ed7 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 | Match/Query Classes
-------------------
ExistsMatch
^^^^^^^^^^^
Checks to see if a specific field exists in a document
.. code-block:: python
:linenos:
from mozdef_util.query_models import ExistsMatch
ExistsMatch("randomfield")
TermMatch
^^^^^^^^^
Checks if a specific field matches the key
.. code-block:: python
:linenos:
from mozdef_util.query_models import TermMatch
TermMatch("details.ip", "127.0.0.1")
TermsMatch
^^^^^^^^^^
Checks if a specific field matches any of the keys
.. code-block:: python
:linenos:
from mozdef_util.query_models import TermsMatch
TermsMatch("details.ip", ["127.0.0.1", "1.2.3.4"])
WildcardMatch
^^^^^^^^^^^^^
Allows regex to be used in looking for documents that a field contains all or part of a key
.. code-block:: python
:linenos:
from mozdef_util.query_models import WildcardMatch
WildcardMatch('summary', 'test*')
PhraseMatch
^^^^^^^^^^^
Checks if a field contains a specific phrase (includes spaces)
.. code-block:: python
:linenos:
from mozdef_util.query_models import PhraseMatch
PhraseMatch('summary', 'test run')
BooleanMatch
^^^^^^^^^^^^
Used to apply specific "matchers" to a query. This will unlikely be used outside of SearchQuery.
.. code-block:: python
:linenos:
from mozdef_util.query_models import ExistsMatch, TermMatch, BooleanMatch
must = [
ExistsMatch('details.ip')
]
must_not = [
TermMatch('type', 'alert')
]
BooleanMatch(must=must, should=[], must_not=must_not)
MissingMatch
^^^^^^^^^^^^
Checks if a field does not exist in a document
.. code-block:: python
:linenos:
from mozdef_util.query_models import MissingMatch
MissingMatch('summary')
RangeMatch
^^^^^^^^^^
Checks if a field value is within a specific range (mostly used to look for documents in a time frame)
.. code-block:: python
:linenos:
from mozdef_util.query_models import RangeMatch
RangeMatch('utctimestamp', "2016-08-12T21:07:12.316450+00:00", "2016-08-13T21:07:12.316450+00:00")
QueryStringMatch
^^^^^^^^^^^^^^^^
Uses a custom query string to generate the "match" based on (Similar to what you would see in kibana)
.. code-block:: python
:linenos:
from mozdef_util.query_models import QueryStringMatch
QueryStringMatch('summary: test')
SubnetMatch
^^^^^^^^^^^^^^^^
Checks if an IP field is within the bounds of a subnet
.. code-block:: python
:linenos:
from mozdef_util.query_models import SubnetMatch
SubnetMatch('details.sourceipaddress', '10.1.1.0/24')
Aggregation
^^^^^^^^^^^
Used to aggregate results based on a specific field
.. code-block:: python
:linenos:
from mozdef_util.query_models import Aggregation, SearchQuery, ExistsMatch
search_query = SearchQuery(hours=24)
must = [
ExistsMatch('seenindicator')
]
search_query.add_must(must)
aggr = Aggregation('details.ip')
search_query.add_aggregation(aggr)
results = search_query.execute(es_client, indices=['events','events-previous'])
|