INNER CODE UNIT · Python

ingest_yaml

panther-labs/panther-analysis · .scripts/generate_indexes.py:74

def ingest_yaml(path):
    with open(path) as file:
        detection = yaml.full_load(file)
    return detection


def analyze_yaml(detection_yaml):
    rv = {}
    if 'Enabled' in detection_yaml:
        rv["Enabled"] = detection_yaml["Enabled"]

    if 'RuleID' in detection_yaml:
        rv["Name"] = detection_yaml["RuleID"]
    elif 'PolicyID' in detection_yaml:
        rv["Name"] = detection_yaml["PolicyID"]
    elif 'QueryName' in detection_yaml:
        rv["Name"] = detection_yaml["QueryName"]

View source record →