mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Lou Stella
56 lines
2.5 KiB
Python
56 lines
2.5 KiB
Python
def list_merge(input_1=None, input_2=None, input_3=None, input_4=None, input_5=None, input_6=None, input_7=None, input_8=None, input_9=None, input_10=None, **kwargs):
|
|
"""
|
|
Merge 2-10 different data paths into a single output data path. For example, if IP addresses are stored in the fields sourceAddress, destinationAddress, and deviceAddress, then those three fields could be merged together to form a single list of IP addresses.
|
|
|
|
Args:
|
|
input_1 (CEF type: *)
|
|
input_2 (CEF type: *)
|
|
input_3 (CEF type: *)
|
|
input_4 (CEF type: *)
|
|
input_5 (CEF type: *)
|
|
input_6 (CEF type: *)
|
|
input_7 (CEF type: *)
|
|
input_8 (CEF type: *)
|
|
input_9 (CEF type: *)
|
|
input_10 (CEF type: *)
|
|
|
|
Returns a JSON-serializable object that implements the configured data paths:
|
|
*.item (CEF type: *): A combined list of all the values from all the input lists
|
|
"""
|
|
############################ Custom Code Goes Below This Line #################################
|
|
import json
|
|
import phantom.rules as phantom
|
|
|
|
outputs = []
|
|
|
|
# loop through all the inputs and use the index to track which input is being processed
|
|
for index, input_value in enumerate([input_1, input_2, input_3, input_4, input_5, input_6, input_7, input_8, input_9, input_10]):
|
|
|
|
# skip the input if no datapath is provided or the datapath does not resolve to anything
|
|
if not input_value:
|
|
phantom.debug("skipping input_{} because it is falsy".format(index+1))
|
|
continue
|
|
|
|
# if the input is not a list just append the single item
|
|
if not isinstance(input_value, list):
|
|
outputs.append({"item": input_value})
|
|
phantom.debug("merged 1 items from input_{}".format(index+1))
|
|
continue
|
|
|
|
# keep track of how many items were merged from each input
|
|
item_count = 0
|
|
|
|
# iterate through the list and append each item in its own dictionary
|
|
for item in input_value:
|
|
if item:
|
|
phantom.debug("input_value is {} and item is {}".format(input_value, item))
|
|
outputs.append({"item": item})
|
|
item_count += 1
|
|
phantom.debug("merged {} items from input_{}".format(item_count, index+1))
|
|
|
|
phantom.debug("merged results: {}".format(outputs))
|
|
|
|
# Return a JSON-serializable object
|
|
assert json.dumps(outputs) # Will raise an exception if the :outputs: object is not JSON-serializable
|
|
return outputs
|