diff --git a/docs/examples/alert_aggregators/basic_concat.py b/docs/examples/alert_aggregators/basic_concat.py index 101c311e..34ca5b4d 100644 --- a/docs/examples/alert_aggregators/basic_concat.py +++ b/docs/examples/alert_aggregators/basic_concat.py @@ -2,7 +2,7 @@ # --8<-- [start:example_1] from detectmatelibrary.alert_aggregation.basic_concat import BasicConcatAggregation -import detectmatelibrary.schemas as schemas +import detectmatelibrary.schemas as sc import yaml @@ -10,7 +10,7 @@ with open("docs/examples/alert_aggregators/basic_concat.yaml") as f: config = yaml.safe_load(f) -input_ = schemas.DetectorSchema({ +input_ = sc.DetectorSchema({ "detectorID": "1", "detectorType": "dummy", "alertID": "2", diff --git a/docs/examples/others/pipeline.py b/docs/examples/others/pipeline.py new file mode 100644 index 00000000..045e1648 --- /dev/null +++ b/docs/examples/others/pipeline.py @@ -0,0 +1,46 @@ +# --8<-- [start:example_1] +from detectmatelibrary.alert_aggregation.logid_count import LogIDCountAggegationConfig + +from detectmatelibrary.parsers.tree_matcher import TemplateCppTreeMatcherConfig + +from detectmatelibrary.detectors.charset_detector import CharsetDetectorConfig + +from detectmatelibrary.pipeline import PipelineConfig, Pipeline +import detectmatelibrary.schemas as schemas + +config = PipelineConfig( + do_parsing=True, # Use the parser + do_aggregation=True, # Use the aggregator + parser=TemplateCppTreeMatcherConfig( + path_templates="docs/examples/data/tutorial_templates.txt", + log_format="type= msg=audit(