class_docstr: Rule engine to processes rules
class_docstr_tok: ["Rule","engine","to","processes","rules"]
docstr: Run rules against the records sent from the Classifier function
  
  Args:
      records (list): Dictionaries of records sent from the classifier function
          Record Format:
              {
                  'cluster': 'prod',
                  'log_schema_type': 'cloudwatch:cloudtrail',
                  'record': {
                      'key': 'value'
                  },
                  'service': 'kinesis',
                  'resource': 'kinesis_stream_name'
                  'data_type': 'json'
              }
  
  Returns:
      list: Alerts that have been triggered by this data
docstr_tok: ["Run","rules","against","the","records","sent","from","the","Classifier","function","Args",":","records","(","list",")",":","Dictionaries","of","records","sent","from","the","classifier","function","Record","Format",":","{","'cluster","'",":","'prod","'",",","'log_schema_type","'",":","'cloudwatch",":","cloudtrail","'",",","'record","'",":","{","'key","'",":","'value'","}",",","'service","'",":","'kinesis","'",",","'resource","'",":","'kinesis_stream_name'","'data_type","'",":","'json'","}","Returns",":","list",":","Alerts","that","have","been","triggered","by","this","data"]
code: def run(self, records):
      """Run rules against the records sent from the Classifier function
  
      Args:
          records (list): Dictionaries of records sent from the classifier function
              Record Format:
                  {
                      'cluster': 'prod',
                      'log_schema_type': 'cloudwatch:cloudtrail',
                      'record': {
                          'key': 'value'
                      },
                      'service': 'kinesis',
                      'resource': 'kinesis_stream_name'
                      'data_type': 'json'
                  }
  
      Returns:
          list: Alerts that have been triggered by this data
      """
      LOGGER.info("Processing %d records", len(records))
  
      # Extract any threat intelligence matches from the records
      self._extract_threat_intel(records)
  
      alerts = []
      for payload in records:
          rules = Rule.rules_for_log_type(payload["log_schema_type"])
          if not rules:
              LOGGER.debug("No rules to process for %s", payload)
              continue
  
          for rule in rules:
              # subkey check
              if not self._process_subkeys(payload["record"], rule):
                  continue
  
              # matcher check
              if not rule.check_matchers(payload["record"]):
                  continue
  
              alert = self._rule_analysis(payload, rule)
              if alert:
                  alerts.append(alert)
  
      self._alert_forwarder.send_alerts(alerts)
  
      # Only log rule info here if this is deployed in Lambda or explicitly enabled
      # During testing, this gets logged at the very end
      if self._rule_stat_tracker.enabled:
          LOGGER.info(RuleStatisticTracker.statistics_info())
  
      MetricLogger.log_metric(
          FUNCTION_NAME, MetricLogger.TRIGGERED_ALERTS, len(alerts)
      )
  
      return alerts
  
imports: from datetime import datetime, timedelta
  from os import environ
  from streamalert.shared.publisher import AlertPublisherRepository
  from streamalert.rules_engine.alert_forwarder import AlertForwarder
  from streamalert.rules_engine.threat_intel import ThreatIntel
  from streamalert.shared import resources, RULES_ENGINE_FUNCTION_NAME
  from streamalert.shared.alert import Alert
  from streamalert.shared.config import load_config
  from streamalert.shared.importer import import_folders
  from streamalert.shared.logger import get_logger
  from streamalert.shared.lookup_tables.core import LookupTables
  from streamalert.shared.metrics import MetricLogger
  from streamalert.shared.rule import Rule
  from streamalert.shared.rule_table import RuleTable
  from streamalert.shared.stats import RuleStatisticTracker
label_desc: Use image node_id 18 for calling the RulesEngine obj's underlying member method code with example usage: obj.run(records) and returns: alerts