brexhq / substation

Substation is a toolkit for routing, normalizing, and enriching security event and audit logs.
https://substation.readme.io
MIT License
322 stars 16 forks source link

feat(condition): Add Number Greater Than Inspector #183

Closed jshlbrd closed 3 months ago

jshlbrd commented 3 months ago

Description

Motivation and Context

This is for comparing a number's value, which is currently only possible using the string_match function like this:

sub.cnd.str.match({ object: {source_key: 'FIELD'}, pattern: '^[0-9]{4,}$'}),  // 1,000+

This inspector is simpler to understand:

sub.cnd.num.greater_than({ object: {source_key: 'FIELD'}, value: 999 }),  // 1,000+

The target value type is float64, but this works just as well with integers.

Additional functions can be added later (e.g. equal_to, less_than). This is nested directly under the number.* tree to mimic the naming convention of the string.* functions. This probably needs to be considered along with #64, which could either be a new set of nested functions (e.g. string.compare.equal_to, number.compare.less_than) or be added to existing functions (e.g., if object.target_key exists, then it overrides value).

How Has This Been Tested?

Added new unit tests.

Types of changes

Checklist: