Python Forum

Hello, I am beginner in Python and I have a text (its content: https://rules.emergingthreats.net/open/s...ised.rules)and I would like to analyze the classtype that satisfies a condition.

I get all the classtype's values in an array but I don't know how to copy all the lines that satisfies the condition. Any help or clue?

Please clearly describe exactly what you are trying to do.
Include:

• Your Goal very clearly please.
  
• What the data is comprised of, it's format, and special information that is known.
  

Quote:I get all the classtype's values in an array but I don't know how to copy all the lines that satisfies the condition. Any help or clue?

means nothing without above

After looking at this site, I think I have a (little) better understanding of what it is you are trying to do.
Perhaps this will be useful: https://rules.emergingthreats.net/PRO_do...tions.html
or this: https://rules.emergingthreats.net/OPEN_d...tions.html

(Apr-17-2018, 06:12 AM)Larz60+ Wrote: [ -> ]After looking at this site, I think I have a (little) better understanding of what it is you are trying to do. Perhaps this will be useful: https://rules.emergingthreats.net/PRO_do...tions.html or this: https://rules.emergingthreats.net/OPEN_d...tions.html

Hello, thank you for answer. My question is that I want to write in a file the 'alerts' that classtype is not in classtypeexception(classtypeexception=['misc-attack','hello']). Sorry for not be clear.

Something like this?

from pathlib import Path


class Security:
    def __init__(self, match_value):
        '''
        Note directory structure:
        put your selected file in threats directory.

        YourSourceDir/
            data/
                threats/
                    EmergingThreats.txt
            src/
                thisProgram.py
        :param match_value: The value you want to select and write to output file
        '''
        self.homepath = Path('.')
        self.rootpath = self.homepath / '..'
        self.datapath = self.rootpath / 'data'
        self.datapath.mkdir(exist_ok=True)
        self.threatpath = self.datapath / 'threats'
        self.threatpath.mkdir(exist_ok=True)

        self.emthreat_file = self.threatpath / 'EmergingThreats.txt'
        self.selections_out = self.threatpath / 'SelectedThreats.txt'
        self.select_output(match_value)

    def select_output(self, match_value):
        with self.emthreat_file.open('r') as f, self.selections_out.open('w') as f1:
            for line in f:
                line = line.strip()
                if line.startswith('#') or len(line) == 0:
                    continue
                cidx = line.index('classtype')
                classtype = line[cidx:]
                cidx = classtype.index(';')
                classtype = classtype[:cidx]
                ctype = classtype.split(':')
                classtype = ctype[1]

                if classtype == match_value:
                    f1.write('{}\n'.format(line))

def testit():
    # change classtype you want selected here
    Security('misc-attack')

if __name__ == '__main__':
    testit()

You can modify this for your exact requirements

(Apr-17-2018, 09:02 AM)Larz60+ Wrote: [ -> ]Something like this?

 from pathlib import Path class Security: def __init__(self, match_value): ''' Note directory structure: put your selected file in threats directory. YourSourceDir/ data/ threats/ EmergingThreats.txt src/ thisProgram.py :param match_value: The value you want to select and write to output file ''' self.homepath = Path('.') self.rootpath = self.homepath / '..' self.datapath = self.rootpath / 'data' self.datapath.mkdir(exist_ok=True) self.threatpath = self.datapath / 'threats' self.threatpath.mkdir(exist_ok=True) self.emthreat_file = self.threatpath / 'EmergingThreats.txt' self.selections_out = self.threatpath / 'SelectedThreats.txt' self.select_output(match_value) def select_output(self, match_value): with self.emthreat_file.open('r') as f, self.selections_out.open('w') as f1: for line in f: line = line.strip() if line.startswith('#') or len(line) == 0: continue cidx = line.index('classtype') classtype = line[cidx:] cidx = classtype.index(';') classtype = classtype[:cidx] ctype = classtype.split(':') classtype = ctype[1] if classtype == match_value: f1.write('{}\n'.format(line)) def testit(): # change classtype you want selected here Security('misc-attack') if __name__ == '__main__': testit() 

You can modify this for your exact requirements

yes!!! thank you so much!!!

I have the same problem on Python, and I just started learning Python.

then look at the solution above, post # 5