class_docstr: Rule engine to processes rules
class_docstr_tok: ["Rule","engine","to","processes","rules"]
docstr: Determine if record contains all subkeys needed for rules
  
  This method verifies that the declared subkeys in a rule are contained
  in the dictionary prior to further rule processing.
  
  Args:
      record (dict): Record to perform subkey checking against
      rule (rule.Rule): Rule class with necessary attributes
  
  Returns:
      bool: result of subkey check.
docstr_tok: ["Determine","if","record","contains","all","subkeys","needed","for","rules","This","method","verifies","that","the","declared","subkeys","in","a","rule","are","contained","in","the","dictionary","prior","to","further","rule","processing",".","Args",":","record","(","dict",")",":","Record","to","perform","subkey","checking","against","rule","(","rule.Rule",")",":","Rule","class","with","necessary","attributes","Returns",":","bool",":","result","of","subkey","check","."]
code: def _process_subkeys(record, rule):
      """Determine if record contains all subkeys needed for rules
  
      This method verifies that the declared subkeys in a rule are contained
      in the dictionary prior to further rule processing.
  
      Args:
          record (dict): Record to perform subkey checking against
          rule (rule.Rule): Rule class with necessary attributes
  
      Returns:
          bool: result of subkey check.
      """
      if not rule.req_subkeys:
          return True
  
      for key, nested_keys in rule.req_subkeys.items():
          # This is an extra layer of protection when
          # verifying a subkey exists in a record with a null value.
          # In the case of CloudTrail, a top level key has been
          # observed as either a map with subkeys, or null.
          if key not in record:
              LOGGER.debug(
                  "The required subkey %s is not found when trying to process %s: \n%s",
                  key,
                  rule.name,
                  record,
              )
              return False
          if not isinstance(record[key], dict):
              LOGGER.debug(
                  "The required subkey %s is not a dictionary when trying to process %s: \n%s",
                  key,
                  rule.name,
                  record,
              )
              return False
          if any(x not in record[key] for x in nested_keys):
              return False
  
      return True
  
imports: from datetime import datetime, timedelta
  from os import environ
  from streamalert.shared.publisher import AlertPublisherRepository
  from streamalert.rules_engine.alert_forwarder import AlertForwarder
  from streamalert.rules_engine.threat_intel import ThreatIntel
  from streamalert.shared import resources, RULES_ENGINE_FUNCTION_NAME
  from streamalert.shared.alert import Alert
  from streamalert.shared.config import load_config
  from streamalert.shared.importer import import_folders
  from streamalert.shared.logger import get_logger
  from streamalert.shared.lookup_tables.core import LookupTables
  from streamalert.shared.metrics import MetricLogger
  from streamalert.shared.rule import Rule
  from streamalert.shared.rule_table import RuleTable
  from streamalert.shared.stats import RuleStatisticTracker
label_desc: Use image node_id 5 for calling the RulesEngine obj's underlying member method code with example usage: obj._process_subkeys(record, rule) and returns: True, True, False, False, False