/* * Copyright OpenSearch Contributors * SPDX-License-Identifier: Apache-2.0 */ package org.opensearch.securityanalytics.rules.condition; import org.opensearch.securityanalytics.rules.exceptions.SigmaConditionError; import org.opensearch.securityanalytics.rules.objects.SigmaCondition; import org.opensearch.securityanalytics.rules.utils.AnyOneOf; import org.opensearch.securityanalytics.rules.utils.Either; import java.util.List; public class ConditionTraverseVisitor extends ConditionBaseVisitor> { private final SigmaCondition sigmaCondition; public ConditionTraverseVisitor(SigmaCondition sigmaCondition) { this.sigmaCondition = sigmaCondition; } @Override public Either visitStart(ConditionParser.StartContext ctx) { return super.visit(ctx.expression()); } @Override public Either visitIdentOrSelectExpression(ConditionParser.IdentOrSelectExpressionContext ctx) { if (ctx.IDENTIFIER() != null) { return Either.right(ctx.IDENTIFIER().getText()); } return Either.right(ctx.SELECTOR().getText()); } @Override public Either visitNotExpression(ConditionParser.NotExpressionContext ctx) { try { Either exp = visit(ctx.expression()); ConditionNOT condition = new ConditionNOT(false, List.of(exp.isLeft()? Either.left(AnyOneOf.leftVal(exp.getLeft())): Either.right(exp.get()))); condition.setArgs(sigmaCondition.convertArgs(condition.getArgs())); return Either.left(condition); } catch (SigmaConditionError ex) { return null; } } @Override public Either visitAndExpression(ConditionParser.AndExpressionContext ctx) { try { Either left = visit(ctx.left); Either right = visit(ctx.right); ConditionAND condition = new ConditionAND(false, List.of( left.isLeft()? Either.left(AnyOneOf.leftVal(left.getLeft())): Either.right(left.get()), right.isLeft()? Either.left(AnyOneOf.leftVal(right.getLeft())): Either.right(right.get()))); condition.setArgs(sigmaCondition.convertArgs(condition.getArgs())); return Either.left(condition); } catch (SigmaConditionError ex) { return null; } } @Override public Either visitOrExpression(ConditionParser.OrExpressionContext ctx) { try { Either left = visit(ctx.left); Either right = visit(ctx.right); ConditionOR condition = new ConditionOR(false, List.of( left.isLeft()? Either.left(AnyOneOf.leftVal(left.getLeft())): Either.right(left.get()), right.isLeft()? Either.left(AnyOneOf.leftVal(right.getLeft())): Either.right(right.get()))); condition.setArgs(sigmaCondition.convertArgs(condition.getArgs())); return Either.left(condition); } catch (SigmaConditionError ex) { return null; } } @Override public Either visitParenExpression(ConditionParser.ParenExpressionContext ctx) { return super.visit(ctx.expression()); } }