RegexExpand

Extract the strings matched to the patterns by doing backslash substitution on the template string. This transformer allow to input multiple regex patterns and multiple match targets, and those can be given in the input value and the argument parameters.

Type

python

Pack

FiltersAndTransformers

Source

import re

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def concat_values(item1: Any, item2: Any) -> list[Any]:
    """
    Concatinate item1 and item2 into a list

    :param item1: The leading values to be concatinated.
    :param item2: The values to add to item1.
    :return: The result in list.
    """
    item1 = item1 or []
    item1 = item1 if isinstance(item1, list) else [item1]
    item1 = [v for v in item1 if v is not None]
    item2 = item2 or []
    item2 = item2 if isinstance(item2, list) else [item2]
    item2 = [v for v in item2 if v is not None]
    return item1 + item2


def expand_template(match: re.Match, template: Any) -> Any:
    """
    Return the string obtained by doing backslash substitution on the template.

    :param match: The match object.
    :param template: The template.
    :return: The template replaced with backslash substitution symbols.
    """
    if template is None:
        return match.group(0)
    elif isinstance(template, str):
        return match.expand(template.replace(r"\0", r"\g<0>"))
    elif isinstance(template, list):
        return [expand_template(match, t) for t in template]
    elif isinstance(template, dict):
        return {expand_template(match, k): expand_template(match, v) for k, v in template.items()}
    else:
        return template


def main():
    args = demisto.args()
    try:
        template = args.get("template")
        template_type = args.get("template_type") or ""
        if template_type == "text":
            pass
        elif template_type == "json":
            template = json.loads(template)
        elif template_type == "list":
            template = argToList(template)
        else:
            raise ValueError(f"Unknown template type: {template_type}")

        regex_flags = 0
        for flag in argToList(args.get("flags")):
            if flag in ("dotall", "s"):
                regex_flags |= re.DOTALL
            elif flag in ("multiline", "m"):
                regex_flags |= re.MULTILINE
            elif flag in ("ignorecase", "i"):
                regex_flags |= re.IGNORECASE
            elif flag in ("unicode", "u"):
                regex_flags |= re.UNICODE
            else:
                raise ValueError(f"Unknown flag: {flag}")

        search_limit = int(args.get("search_limit") or 0)
        if search_limit < 0:
            raise ValueError(f"Bad search limit: {search_limit}")

        results: list[Any] = []
        value_takes = args.get("value_takes") or "text"
        if value_takes == "text":
            # Pattern matching for each text in the input order
            regex_list = concat_values(args.get("regex"), [])
            text_list = concat_values(args.get("value"), args.get("text"))

            regexes = [re.compile(str(r), flags=regex_flags) for r in regex_list if isinstance(r, str | int)]
            for text in text_list:
                for regex in regexes:
                    for i, match in enumerate(re.finditer(regex, str(text)), start=1):
                        results = concat_values(results, expand_template(match, template))
                        if search_limit != 0 and search_limit <= i:
                            break

        elif value_takes == "regex":
            # Pattern matching for each regex in the input order
            regex_list = concat_values(args.get("value"), args.get("regex"))
            text_list = concat_values(args.get("text"), [])

            for regex_pattern in regex_list:
                if isinstance(regex_pattern, str | int):
                    regex = re.compile(str(regex_pattern), flags=regex_flags)
                    for text in text_list:
                        for i, match in enumerate(re.finditer(regex, str(text)), start=1):
                            results = concat_values(results, expand_template(match, template))
                            if search_limit != 0 and search_limit <= i:
                                break
        else:
            raise ValueError(f"Unknown value_takes: {value_takes}")

        return_results(results)
    except Exception as err:
        # Don't return an error by return_error() as this is transformer.
        raise DemistoException(str(err))


if __name__ in ("__builtin__", "builtins", "__main__"):
    main()

README