INNER CODE UNIT · Python

analyze_yaml

panther-labs/panther-analysis · .scripts/generate_indexes.py:80

def analyze_yaml(detection_yaml):
    rv = {}
    if 'Enabled' in detection_yaml:
        rv["Enabled"] = detection_yaml["Enabled"]

    if 'RuleID' in detection_yaml:
        rv["Name"] = detection_yaml["RuleID"]
    elif 'PolicyID' in detection_yaml:
        rv["Name"] = detection_yaml["PolicyID"]
    elif 'QueryName' in detection_yaml:
        rv["Name"] = detection_yaml["QueryName"]

    if 'AnalysisType' in detection_yaml:
        rv["AnalysisType"] = detection_yaml["AnalysisType"]
    display_name = ''
    if 'QueryName' in detection_yaml:
        display_name = detection_yaml["QueryName"]
    elif 'DisplayName' in detection_yaml:

View source record →