class_docstr: Rule engine to processes rules
class_docstr_tok: ["Rule","engine","to","processes","rules"]
docstr: Analyze a record with the rule, adding a new alert if applicable
  
  Args:
      payload (dict): Representation of event to perform rule analysis against
      rule (rule.Rule): Attributes for the rule which triggered the alert
docstr_tok: ["Analyze","a","record","with","the","rule",",","adding","a","new","alert","if","applicable","Args",":","payload","(","dict",")",":","Representation","of","event","to","perform","rule","analysis","against","rule","(","rule.Rule",")",":","Attributes","for","the","rule","which","triggered","the","alert"]
code: def _rule_analysis(self, payload, rule):
      """Analyze a record with the rule, adding a new alert if applicable
  
      Args:
          payload (dict): Representation of event to perform rule analysis against
          rule (rule.Rule): Attributes for the rule which triggered the alert
      """
      # Run the rule, using the statistic tracker in case stats are being tracked
      rule_result = self._rule_stat_tracker.run_rule(
          rule, payload["record"]
      )
      if not rule_result:
          return
  
      # Define the outputs
      outputs = self._configure_outputs(payload["record"], rule)
  
      alert = Alert(
          rule.name,
          payload["record"],
          outputs,
          cluster=payload["cluster"],
          context=rule.context,
          log_source=payload["log_schema_type"],
          log_type=payload["data_type"],
          merge_by_keys=rule.merge_by_keys,
          merge_window=timedelta(minutes=rule.merge_window_mins),
          publishers=self._configure_publishers(rule, outputs),
          rule_description=rule.description,
          source_entity=payload["resource"],
          source_service=payload["service"],
          staged=rule.is_staged(self._rule_table),
      )
  
      LOGGER.info(
          "Rule '%s' triggered alert '%s' on log type '%s' from resource '%s' "
          "in service '%s'",
          rule.name,
          alert.alert_id,
          payload["log_schema_type"],
          payload["resource"],
          payload["service"],
      )
  
      return alert
  
imports: from datetime import datetime, timedelta
  from os import environ
  from streamalert.shared.publisher import AlertPublisherRepository
  from streamalert.rules_engine.alert_forwarder import AlertForwarder
  from streamalert.rules_engine.threat_intel import ThreatIntel
  from streamalert.shared import resources, RULES_ENGINE_FUNCTION_NAME
  from streamalert.shared.alert import Alert
  from streamalert.shared.config import load_config
  from streamalert.shared.importer import import_folders
  from streamalert.shared.logger import get_logger
  from streamalert.shared.lookup_tables.core import LookupTables
  from streamalert.shared.metrics import MetricLogger
  from streamalert.shared.rule import Rule
  from streamalert.shared.rule_table import RuleTable
  from streamalert.shared.stats import RuleStatisticTracker
label_desc: Use image node_id 7 for calling the RulesEngine obj's underlying member method code with example usage: obj._rule_analysis(payload, rule) and returns: alert