<commit_before>Code
====

Plugins
-------

The front-end event processing portion of MozDef supports python plugins to allow customization of the input chain. 
Plugins are simple python modules than can register for events with a priority, so they only see events with certain
dictionary items/values and will get them in a predefined order. 

To create a plugin, make a python class that presents a registration dictionary and a priority as follows: 

::

  class message(object):
      def __init__(self):
          '''register our criteria for being passed a message
             return a dict with fieldname:None to be sent anything with that field
             return a dict with fieldname:Value to be sent anything with that field/value
             return a string to be sent anything with any field matching that string evaluated as a regex.
             set the priority if you have a preference for order of plugins to run.
             0 goes first, 100 is assumed/default if not sent
          '''
          
          rdict = dict()
          rdict['details'] = dict()
          rdict['details']['sourceipaddress'] = None
          rdict['details']['destinationipaddress'] = None
          self.registration = rdict
          self.priority = 1
          

Message Processing
++++++++++++++++++

To process a message, define an onMessage function within your class as follows: 

::

    def onMessage(self, message):
        return message


The plugin will receive a copy of the incoming event as a python dictionary in the 'message' variable. The plugin can do
whatever it wants with this dictionary and return it to MozDef. Plugins will be called in priority order 1 to 100 if the 
incoming event matches their registration criteria. i.e. If you register for sourceipaddress you will only get events containing
the sourceipaddress field.


Plugin Registration
+++++++++++++++++++

Simply place the .py file in the plugins directory where the esworker.py is located, restart the esworker.py process
and it will recognize the plugin and pass it events as it sees them. 








<commit_msg>consistency in ordering 0,100 and plugin link<commit_after>Code
====

Plugins
-------

The front-end event processing portion of MozDef supports python `plugins`_ to allow customization of the input chain. 
Plugins are simple python modules than can register for events with a priority, so they only see events with certain
dictionary items/values and will get them in a predefined order. 

To create a plugin, make a python class that presents a registration dictionary and a priority as follows: 

::

  class message(object):
      def __init__(self):
          '''register our criteria for being passed a message
             return a dict with fieldname:None to be sent anything with that field
             return a dict with fieldname:Value to be sent anything with that field/value
             return a string to be sent anything with any field matching that string evaluated as a regex.
             set the priority if you have a preference for order of plugins to run.
             0 goes first, 100 is assumed/default if not sent
          '''
          
          rdict = dict()
          rdict['details'] = dict()
          rdict['details']['sourceipaddress'] = None
          rdict['details']['destinationipaddress'] = None
          self.registration = rdict
          self.priority = 1
          

Message Processing
++++++++++++++++++

To process a message, define an onMessage function within your class as follows: 

::

    def onMessage(self, message):
        return message


The plugin will receive a copy of the incoming event as a python dictionary in the 'message' variable. The plugin can do
whatever it wants with this dictionary and return it to MozDef. Plugins will be called in priority order 0 to 100 if the 
incoming event matches their registration criteria. i.e. If you register for sourceipaddress you will only get events containing
the sourceipaddress field.


Plugin Registration
+++++++++++++++++++

Simply place the .py file in the plugins directory where the esworker.py is located, restart the esworker.py process
and it will recognize the plugin and pass it events as it sees them. 




.. _plugins: https://github.com/jeffbryner/MozDef/tree/master/mq/plugins




{'fraction_non_alphanumeric': 0.06492000927428704, 'fraction_numerical': 0.005100857871551124, 'mean_word_length': 2.9944444444444445, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 1, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6051487', 'n_tokens_mistral': 1048, 'n_tokens_neox': 980, 'n_words': 558}