private void ProcessAggregateAlertsCodeGen(string productId)
{
Regex r1 = new Regex(@"ProcessAggregateAlerts\s{0,}\(\s{0,}(.*?)\s{0,}\)", RegexOptions.IgnoreCase);
MatchCollection m1 = r1.Matches(_code);
if (m1 != null && m1.Count > 0)
{
foreach (Match m in m1)
{
_statementNumber++;
string targetTable = m.Groups[1].Value;
if (string.IsNullOrEmpty(targetTable))
{
targetTable = _DefaultTargetName;
}
List <Rule> rules = new List <Rule>();
if (string.IsNullOrEmpty(productId))
{
rules = _allrules.Where(r => r.RuleType == "AggregateRule" && r.TargetTable == targetTable && r.Isalert).ToList();
}
else
{
rules = _allrules.Where(r => r.ProductId == productId && r.RuleType == "AggregateRule" && r.TargetTable == targetTable && r.Isalert).ToList();
}
queriesQuery queryTemplate = _queryTemplates.Items.Where(q => q.type == "AggregateAlert").FirstOrDefault();
string s = GenerateCodeHelper(rules, queryTemplate, targetTable);
_code = _code.Replace(m.Groups[0].Value, s);
}
}
}
private void ProcessAggregateRulesCodeGen(string productId)
{
Regex r1 = new Regex(@"(.*?)\s{0,}=\s{0,}ProcessAggregateRules\s{0,}\(\s{0,}(.*?)\s{0,}\)", RegexOptions.IgnoreCase);
MatchCollection m1 = r1.Matches(_code);
if (m1 != null && m1.Count > 0)
{
foreach (Match m in m1)
{
_statementNumber++;
string targetTable = m.Groups[2].Value;
if (string.IsNullOrEmpty(targetTable))
{
targetTable = _DefaultTargetName;
}
List <Rule> rules = new List <Rule>();
if (string.IsNullOrEmpty(productId))
{
rules = _allrules.Where(r => r.RuleType == "AggregateRule" && r.TargetTable == targetTable).ToList();
}
else
{
rules = _allrules.Where(r => r.ProductId == productId && r.RuleType == "AggregateRule" && r.TargetTable == targetTable).ToList();
}
queriesQuery queryTemplate = _queryTemplates.Items.Where(q => q.type == "AggregateRule").FirstOrDefault();
string s = GenerateCodeHelper(rules, queryTemplate, targetTable);
// Now generate the Union statement
s += "\n\n--DataXQuery--\n";
s += $"ar4_{ _statementNumber} = ";
for (int i = 1; i < _ruleCounter; i++)
{
if (i == _ruleCounter - 1)
{
s += $"SELECT * FROM ar3_{ _statementNumber}_{i}";
}
else
{
s += $"SELECT * FROM ar3_{ _statementNumber}_{i} UNION ";
}
}
// Now return the dataset to user
s += "\n\n--DataXQuery--\n";
s += $"$return = SELECT * FROM ar4_{ _statementNumber}";
s = s.Replace("\n", "\r\n");
s = s.Replace("$return", m.Groups[1].Value);
_code = _code.Replace(m.Groups[0].Value, s);
}
}
}
private void ProcessRulesCodeGen(string productId)
{
Regex r1 = new Regex(@"(.*?)\s{0,}=\s{0,}ProcessRules\s{0,}\(\s{0,}(.*?)\s{0,}\)", RegexOptions.IgnoreCase);
MatchCollection m1 = r1.Matches(_code);
if (m1 != null && m1.Count > 0)
{
foreach (Match m in m1)
{
_statementNumber++;
string targetTable = m.Groups[2].Value;
if (string.IsNullOrEmpty(targetTable))
{
targetTable = _DefaultTargetName;
}
List <Rule> rules = new List <Rule>();
if (string.IsNullOrEmpty(productId))
{
rules = _allrules.Where(r => r.RuleType == "SimpleRule" && r.TargetTable == targetTable).ToList();
}
else
{
rules = _allrules.Where(r => r.ProductId == productId && r.RuleType == "SimpleRule" && r.TargetTable == targetTable).ToList();
}
queriesQuery queryTemplate = _queryTemplates.Items.Where(q => q.type == "SimpleRule").FirstOrDefault();
string s = queryTemplate.Value.Replace("$arrayConditions", CreateArrayConditions(rules));
s = s.Replace("\n", "\r\n");
s = s.Replace("$return", m.Groups[1].Value);
s = s.Replace(_DefaultTargetName, targetTable);
_code = _code.Replace(m.Groups[0].Value, s);
}
}
}
private string GenerateCodeHelper(List <Rule> rules, queriesQuery queryTemplate, string inputTable = "DataXProcessedInput")
{
if (rules == null || rules.Count <= 0)
{
return("");
}
_ruleCounter = 1;
string result = "";
foreach (Rule rule in rules)
{
result += queryTemplate.Value.Trim();
// Apply outputtemplate
Regex r = new Regex(@"ApplyTemplate\s{0,}\(\s{0,}(.*?)\s{0,},\s{0,}(.*?)\s{0,}\)", RegexOptions.IgnoreCase);
MatchCollection m1 = r.Matches(result);
if (m1 != null && m1.Count > 0)
{
foreach (Match m in m1)
{
outputTemplatesOutputTemplate o = null;
if (m.Groups[2].Value == "$outputTemplate")
{
if (!string.IsNullOrEmpty(rule.OutputTemplate))
{
o = _outputTemplates.Items.Where(ot => ot.id == rule.OutputTemplate).FirstOrDefault();
}
else if (rule.RuleType.ToLower().Contains("aggregate"))
{
o = _outputTemplates.Items.Where(ot => ot.id == "defaultAggOutputTemplate").FirstOrDefault();
}
}
else
{
o = _outputTemplates.Items.Where(ot => ot.id == m.Groups[2].Value).FirstOrDefault();
}
if (o == null)
{
string s = $"SELECT * FROM {m.Groups[1].Value}";
result = result.Replace(m.Groups[0].Value, s);
}
else
{
string templateValue = o.Value;
templateValue = templateValue.Replace("$aggstemplate", rule.AggsToTemplate());
templateValue = templateValue.Replace("$pivotstemplate", rule.PivotsToTemplate());
string s = $"SELECT {templateValue} FROM {m.Groups[1].Value}";
result = result.Replace(m.Groups[0].Value, s);
}
}
}
// If there are no alert sinks OR the output for the simple or aggregate alert is Metrics table only, then we take out the Output statement as we want to send the $tagAlert table to Metrics
if (rule.Alertsinks == null || (rule.Alertsinks.Count == 1 && rule.Alertsinks[0] == "Metrics"))
{
result = result.Replace("OUTPUT aa3_$ruleCounter TO $alertsinks;", "");
result = result.Replace("OUTPUT sa2_$ruleCounter TO $alertsinks;", "");
}
else // Else if there are more Alertsinks, then we take out Metrics as a sink since we send $tagAlert table to Metrics explicitly
{
result = result.Replace("$alertsinks", rule.ListToString(rule.Alertsinks.Where(item => item != "Metrics").ToList()));
}
result = result.Replace("$productId", rule.ProductId);
result = result.Replace("$ruleId", rule.RuleId);
result = result.Replace("$ruleCounter", $"{_statementNumber}_{_ruleCounter}");
result = result.Replace("$ruleDescription", rule.RuleDescription);
result = result.Replace("$ruleCategory", rule.RuleCategory);
result = result.Replace("$ruleType", rule.RuleType);
result = result.Replace("$severity", rule.Severity);
result = result.Replace("$aggs", rule.AggsToSelect());
result = result.Replace("$condition", rule.ConditionToSQL());
result = result.Replace("$tagname", rule.Tagname);
result = result.Replace("$tag", rule.Tag);
result = result.Replace("$sinks", rule.ListToString(rule.Sinks));
result = result.Replace("$ruleObject", rule.RulesObject());
result = result.Replace("$id", rule.Id);
result = result.Replace("$fact", rule.Fact);
result = result.Replace("DataXProcessedInput", inputTable);
if (rule.Pivots == null || rule.Pivots.Count <= 0)
{
result = result.Replace("GROUP BY $pivots", "");
result = result.Replace("$pivots,", "");
}
else
{
result = result.Replace("$pivots", rule.ListToString(rule.Pivots));
}
_ruleCounter++;
}
result = result.Replace("\n", "\r\n");
return(result);
}
