<commit_before>import os
import json

from lib.alerttask import AlertTask
from mozdef_util.query_models import SearchQuery, QueryStringMatch


_CONFIG_FILE = os.path.join(
    os.path.dirname(__file__),
    'sensitiveuser_uid0.json')


class AlertSensitiveUserUID0(AlertTask):
    '''Alert when an event is observed to have been triggered by any of a
    configured list of users with uid 0.
    '''

    def main(self):
        '''Search for events triggered by any of a configured list of users.
        '''

        with open(_CONFIG_FILE) as cfg_file:
            self.config = json.load(cfg_file)

        user_conditions = ' OR '.join([
            'details.user: {}'.format(user)
            for user in self.config['sensitiveUsers']
        ])
        lucene_query = 'details.uid: 0 AND (' + user_conditions + ')'

        query = SearchQuery(**self.config['searchWindow'])
        query.add_must(QueryStringMatch(lucene_query))

        self.filtersManual(query)
        self.searchEventsSimple()
        self.walkEvents()


    def onEvent(self, event):
        '''Construct an alert for each event found.
        '''

        category = 'anomaly'
        tags = ['uid0', 'anomaly']
        severity = 'CRITICAL'
        summary = 'User {0} with uid 0 active on host {1}'.format(
            event['_source']['details']['user'],
            event['_source']['hostname'])

        return self.createAlertDict(summary, category, tags, [event], severity)<commit_msg>Satisfy linter gods<commit_after>import os
import json

from lib.alerttask import AlertTask
from mozdef_util.query_models import SearchQuery, QueryStringMatch


_CONFIG_FILE = os.path.join(
    os.path.dirname(__file__),
    'sensitiveuser_uid0.json')


class AlertSensitiveUserUID0(AlertTask):
    '''Alert when an event is observed to have been triggered by any of a
    configured list of users with uid 0.
    '''

    def main(self):
        '''Search for events triggered by any of a configured list of users.
        '''

        with open(_CONFIG_FILE) as cfg_file:
            self.config = json.load(cfg_file)

        user_conditions = ' OR '.join([
            'details.user: {}'.format(user)
            for user in self.config['sensitiveUsers']
        ])
        lucene_query = 'details.uid: 0 AND (' + user_conditions + ')'

        query = SearchQuery(**self.config['searchWindow'])
        query.add_must(QueryStringMatch(lucene_query))

        self.filtersManual(query)
        self.searchEventsSimple()
        self.walkEvents()

    def onEvent(self, event):
        '''Construct an alert for each event found.
        '''

        category = 'anomaly'
        tags = ['uid0', 'anomaly']
        severity = 'CRITICAL'
        summary = 'User {0} with uid 0 active on host {1}'.format(
            event['_source']['details']['user'],
            event['_source']['hostname'])

        return self.createAlertDict(summary, category, tags, [event], severity)
{'fraction_non_alphanumeric': 0.1145374449339207, 'fraction_numerical': 0.005421890884445951, 'mean_word_length': 2.662531017369727, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5909831', 'n_tokens_mistral': 863, 'n_tokens_neox': 820, 'n_words': 231}