#NEWLINE# def Start( self ) : #NEWLINE# #INDENT# 'This uploads the rules to the foreman and, thus, starts the hunt.' #NEWLINE# if ( self . flow_obj . Get ( self . flow_obj . Schema . STATE ) == 'STARTED' ) : #NEWLINE# #INDENT# return #NEWLINE# #UNINDENT# data_store . DB . security_manager . CheckHuntAccess ( self . flow_obj . token , foreman_rules . session_id ) #NEWLINE# self . context . expires = self . args . expiry_time . Expiry ( ) #NEWLINE# self . context . next_client_due = rdfvalue . RDFDatetime ( ) . Now ( ) #NEWLINE# self . _CreateAuditEvent ( 'HUNT_STARTED' ) #NEWLINE# self . flow_obj . Set ( self . flow_obj . Schema . STATE ( 'STARTED' ) ) #NEWLINE# self . flow_obj . Flush ( ) #NEWLINE# if ( not self . args . add_foreman_rules ) : #NEWLINE# #INDENT# return #NEWLINE# #UNINDENT# foreman_rule = rdf_foreman . ForemanRule ( created = rdfvalue . RDFDatetime ( ) . Now ( ) , expires = self . context . expires , description = ( 'Hunt %s %s' % ( self . session_id , self . args . hunt_name ) ) , regex_rules = self . args . regex_rules , integer_rules = self . args . integer_rules , client_rule_set = self . args . client_rule_set ) #NEWLINE# foreman_rule . actions . Append ( hunt_id = self . session_id , hunt_name = self . args . hunt_name , client_limit = self . args . client_limit ) #NEWLINE# foreman_rule . Validate ( ) #NEWLINE# with aff4 . FACTORY . Open ( 'aff4:/foreman' , mode = 'rw' , token = self . token , aff4_type = 'GRRForeman' , ignore_cache = True ) as foreman : #NEWLINE# #INDENT# foreman_rules = foreman . Get ( foreman . Schema . RULES , default = foreman . Schema . RULES ( ) ) #NEWLINE# foreman_rules . Append ( foreman_rule ) #NEWLINE# foreman . Set ( foreman_rules )