Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
sys.exit(1)
# Sanity check that the args exist and are what we expect
if not os.path.isfile(args.rule_index):
print('--rule-index file not found.. should be /full/path/to/yara/rules/index.yar')
sys.exit(1)
if not os.path.isdir(args.extract_dir):
print('--extract-dir directory not found.. should be /full/path/to/bro/extract_files')
sys.exit(1)
# Load/compile the yara rules
my_rules = yara.compile(args.rule_index)
# Create DirWatcher and start watching the Zeek extract_files directory
print('Watching Extract Files Directory: {:s}'.format(args.extract_dir))
dir_watcher.DirWatcher(args.extract_dir, callback=yara_match, rules=my_rules)
# Okay so just wait around for files to be dropped by Zeek or someone hits Ctrl-C
with signal_utils.signal_catcher(my_exit):
while True:
time.sleep(.5)
def test():
"""Test the DirWatcher Class"""
watch_path = file_utils.relative_dir(__file__, '../../data')
print('Watching Directory: %s' % watch_path)
DirWatcher(watch_path, my_callback)
# Create a file and then delete it
temp_file = os.path.join(watch_path, 'test.tmp')
open(temp_file, 'w').close()
time.sleep(1)
os.remove(temp_file)