add rule group creation

Author: Infinit3i

gui/rule_editor.py

@@ -30,6 +30,14 @@ def __init__(self, config: SysmonConfig) -> None:
         self.rule_type = QComboBox()
         self.rule_type.addItems(["include", "exclude"])
 
+        self.group_box = QComboBox()
+        self.group_box.setEditable(True)
+        self.group_box.setInsertPolicy(QComboBox.InsertPolicy.NoInsert)
+        self.group_box.setPlaceholderText("Select or type rule group (optional)")
+
+        self.group_relation = QComboBox()
+        self.group_relation.addItems(["or", "and"])
+
         self.field_box = QComboBox()
 
         self.condition_box = QComboBox()
@@ -52,11 +60,16 @@ def __init__(self, config: SysmonConfig) -> None:
         self.rule_row_1.addWidget(self.field_box)
         self.rule_row_1.addWidget(self.condition_box)
 
+        self.group_row = QHBoxLayout()
+        self.group_row.addWidget(self.group_box)
+        self.group_row.addWidget(self.group_relation)
+
         self.rule_row_2 = QHBoxLayout()
         self.rule_row_2.addWidget(self.value_preset_box)
         self.rule_row_2.addWidget(self.value_input)
 
         self.layout.addWidget(self.title)
+        self.layout.addLayout(self.group_row)
         self.layout.addLayout(self.rule_row_1)
         self.layout.addLayout(self.rule_row_2)
         self.layout.addWidget(self.add_button)
@@ -66,14 +79,62 @@ def __init__(self, config: SysmonConfig) -> None:
         self.add_button.clicked.connect(self.add_rule)
         self.remove_button.clicked.connect(self.remove_selected_rule)
         self.field_box.currentTextChanged.connect(self.load_value_presets_for_field)
+        self.group_box.currentIndexChanged.connect(self.on_group_selected)
 
     def set_event(self, event_id: int, event_name: str) -> None:
         self.current_event_id = event_id
         self.current_event_name = event_name
         self.title.setText(f"{event_id} - {event_name}")
         self.load_fields_for_event()
+        self.refresh_group_options()
         self.refresh_rules()
 
+    def refresh_group_options(self) -> None:
+        self.group_box.blockSignals(True)
+        self.group_box.clear()
+        self.group_box.addItem("")
+        self.group_box.setItemData(0, None, Qt.ItemDataRole.UserRole)
+
+        if self.current_event_id is None:
+            self.group_box.blockSignals(False)
+            return
+
+        event_config = self.config.events.get(self.current_event_id)
+        if event_config is None:
+            self.group_box.blockSignals(False)
+            return
+
+        seen_group_ids: set[str] = set()
+        for rule in event_config.rules:
+            if not rule.group_id or rule.group_id in seen_group_ids:
+                continue
+            seen_group_ids.add(rule.group_id)
+
+            group_name = rule.group_name or "Imported Rule"
+            group_relation = rule.group_relation or "or"
+            label = f"{group_name} ({group_relation})"
+            self.group_box.addItem(label)
+            self.group_box.setItemData(
+                self.group_box.count() - 1,
+                {
+                    "group_id": rule.group_id,
+                    "group_name": rule.group_name,
+                    "group_relation": group_relation,
+                },
+                Qt.ItemDataRole.UserRole,
+            )
+
+        self.group_box.blockSignals(False)
+
+    def on_group_selected(self, *_args) -> None:
+        selected_data = self.group_box.currentData(Qt.ItemDataRole.UserRole)
+        if not isinstance(selected_data, dict):
+            return
+
+        selected_relation = selected_data.get("group_relation")
+        if selected_relation in ("or", "and"):
+            self.group_relation.setCurrentText(selected_relation)
+
     def load_fields_for_event(self) -> None:
         from data.sysmon_fields import SYS_MON_FIELDS
 
@@ -169,17 +230,60 @@ def add_rule(self) -> None:
             self.current_event_name,
         )
 
+        selected_group_data = self.group_box.currentData(Qt.ItemDataRole.UserRole)
+        selected_group_text = self.group_box.currentText().strip()
+
+        group_id: str | None = None
+        group_name: str | None = None
+        group_relation: str | None = None
+
+        if isinstance(selected_group_data, dict):
+            group_id = selected_group_data.get("group_id")
+            group_name = selected_group_data.get("group_name")
+            group_relation = selected_group_data.get("group_relation")
+        elif selected_group_text:
+            existing_group = None
+            for existing_rule in event_config.rules:
+                if not existing_rule.group_id:
+                    continue
+                if (existing_rule.group_name or "").strip().lower() == selected_group_text.lower():
+                    existing_group = existing_rule
+                    break
+
+            if existing_group is not None:
+                group_id = existing_group.group_id
+                group_name = existing_group.group_name
+                group_relation = existing_group.group_relation or self.group_relation.currentText()
+            else:
+                existing_ids = {
+                    existing_rule.group_id
+                    for existing_rule in event_config.rules
+                    if existing_rule.group_id
+                }
+                next_index = 1
+                group_id = f"user-group-{next_index}"
+                while group_id in existing_ids:
+                    next_index += 1
+                    group_id = f"user-group-{next_index}"
+
+                group_name = selected_group_text
+                group_relation = self.group_relation.currentText()
+
         event_config.rules.append(
             RuleFilter(
                 rule_type=self.rule_type.currentText(),
                 field_name=self.field_box.currentText(),
                 condition=self.condition_box.currentText(),
                 value=value,
+                group_id=group_id,
+                group_name=group_name,
+                group_relation=group_relation,
             )
         )
 
         self.value_input.clear()
         self.value_preset_box.setCurrentIndex(0)
+        self.refresh_group_options()
         self.refresh_rules()
 
     def remove_selected_rule(self) -> None:
@@ -203,4 +307,5 @@ def remove_selected_rule(self) -> None:
         if 0 <= rule_index < len(event_config.rules):
             del event_config.rules[rule_index]
 
+        self.refresh_group_options()
         self.refresh_rules()