https://github.com/shuffle/detection-parser
Open-source email security rules. Written in go, importable in python :)
https://github.com/shuffle/detection-parser
Last synced: 10 months ago
JSON representation
Open-source email security rules. Written in go, importable in python :)
- Host: GitHub
- URL: https://github.com/shuffle/detection-parser
- Owner: Shuffle
- Created: 2024-06-29T22:11:23.000Z (almost 2 years ago)
- Default Branch: main
- Last Pushed: 2024-09-26T13:59:30.000Z (over 1 year ago)
- Last Synced: 2025-07-20T00:38:10.051Z (11 months ago)
- Language: Python
- Homepage: https://pypi.org/project/shuffle-heimdall/
- Size: 36.7 MB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# Introduction
Detection rule parser for everyone with focus on Email
## Installation
```bash
pip3 install shuffle-heimdall
```
## Usage
```python
from heimdall.evaluate import evaluate_email_expression
sender = """{
"email": {
"domain": {
"domain": "shuffler.io"
},
"email": "support@shuffler.io"
}
}"""
expression = 'sender.email.domain.domain == "twitter.com"'
result = evaluate_email_expression(sender, expression)
print(result)
## Try out file based evaluation
from heimdall.evaluate import evaluate_file_expression
file_path = "rules/impersonation_of_twitter.yml"
sender = """{
"email": {
"domain": {
"domain": "nottwitter.com"
}
}
}"""
result = evaluate_file_expression(file_path, sender)
print(result)
```
To see more examples, check out the [main.py](./heimdall/main.py) file.
## To-do
Works on most platforms. The power of heimdall should shine when you have a lot of emails to process but you want to write simple code that is also fast.
- [ ] Add support for outlook API result
- [x] Add support for gmail API result (`evaluate_gmail_expression()`)
- [ ] Add support for gmail API when in mass
- [ ] Make setup.py pull the right binary during install instead of having everything in the repo.
## Dev
1. Building the package
```bash
python3 setup.py sdist bdist_wheel
```