Filter

Filter will filter the data based on the given criteria.

class duetector.filters.base.Filter(config: Config | dict[str, Any] | None = None, *args, **kwargs)[source]

A base class for all filters.

Default config scope is filter.{class_name}.

subclass should override filter method.

User should call Filter() directly to filter data,

Example

from duetector.filters import Filter
from collections import namedtuple

class MyFilter(Filter):
    def filter(self, data: namedtuple) -> namedtuple | None:
        if data.fname == "/etc/passwd":
            return None
        return data

f = MyFilter()
data_t = namedtuple("Tracking", "fname")
f(data_t(fname="/etc/passwd"))  # None
f(data_t(fname="/etc/shadow"))  # Tracking(fname="/etc/shadow")
property config_scope

Config scope for current filter.

default_config = {'disabled': False}

Default config for Filter.

property disabled

If current filter is disabled.

filter(data: namedtuple) → namedtuple | None[source]

Filter data, return None to drop data, return data to keep data.

Avaliable Filter