mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
new detection test
This commit is contained in:
@@ -112,17 +112,19 @@ def read_data(file_name):
|
||||
date_rex = r'\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2} [AP]M'
|
||||
count = len(open(modified_file).readlines())
|
||||
i = 0
|
||||
tmp_counter = 0
|
||||
for line in fileinput.input(files=modified_file):
|
||||
i = i + 1
|
||||
if event != "" and re.match(date_rex, line):
|
||||
data.append(event)
|
||||
tmp_counter = 0
|
||||
event = line
|
||||
else:
|
||||
tmp_counter = tmp_counter + 1
|
||||
event = event + line
|
||||
|
||||
if i == count:
|
||||
if len(data) == 0:
|
||||
data.append(event)
|
||||
if i == count and tmp_counter > 10:
|
||||
data.append(event)
|
||||
|
||||
return data
|
||||
|
||||
|
||||
Reference in New Issue
Block a user