Commit8ef36aa

committed

fix qradar logsource parsing

1 parent29fa729 commit8ef36aaCopy full SHA for 8ef36aa

File tree

-3

lines changed

uncoder-core/app/translator/platforms
- base/aql/parsers
  - aql.py
- sigma/parsers
  - sigma.py

-3

lines changed

Lines changed: 2 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -37,13 +37,13 @@ class AQLQueryParser(PlatformQueryParser):`
`37`	`37`	`log_source_functions= ("LOGSOURCENAME","LOGSOURCEGROUPNAME")`
`38`	`38`	`log_source_function_pattern=r"$?(?P<key>___func_name___\([a-zA-Z]+$)(?:\s+like\s+\|\s+ilike\s+\|\s=\s)'(?P<value>[%a-zA-Z\s]+)'\s*\)?\s+(?:and\|or)?\s"# noqa: E501`
`39`	`39`
`40`		`-log_source_key_types= ("devicetype","category","qid","qideventcategory",*LOG_SOURCE_FUNCTIONS_MAP.keys())`
	`40`	`+log_source_key_types= ("devicetype","qideventcategory","category","qid",*LOG_SOURCE_FUNCTIONS_MAP.keys())`
`41`	`41`	`log_source_pattern=rf"___source_type___(?:\s+like\s+\|\s+ilike\s+\|\s=\s)(?:{SINGLE_QUOTES_VALUE_PATTERN}\|{NUM_VALUE_PATTERN})(?:\s+(?:and\|or)\s+\|\s+)?"# noqa: E501`
`42`	`42`	`num_value_pattern=r"[0-9]+"`
`43`	`43`	`multi_num_log_source_pattern= (`
`44`	`44`	`rf"___source_type___\s+in\s+$(?P<value>(?:{num_value_pattern}(?:\s,\s)?)+)$(?:\s+(?:and\|or)\s+\|\s+)?"`
`45`	`45`	`)`
`46`		`-str_value_pattern=r"""(?:')(?P<s_q_value>(?:[:a-zA-Z\*0-9=+%#\-\/\\,_".$&^@!\{\}\s]\|'')+)(?:')"""`
	`46`	`+str_value_pattern=r"""'(?P<s_q_value>(?:[:a-zA-Z\*0-9=+%#\-\/\\,_".$&^@!\{\}\s]\|'')+)'"""`
`47`	`47`	`multi_str_log_source_pattern= (`
`48`	`48`	`rf"""___source_type___\s+in\s+$(?P<value>(?:{str_value_pattern}(?:\s,\s)?)+)$(?:\s+(?:and\|or)\s+\|\s+)?"""`
`49`	`49`	`)`

Lines changed: 0 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,6 @@`
`18`	`18`	`"""`
`19`	`19`
`20`	`20`	`fromdatetimeimporttimedelta`
`21`		`-fromreimportI`
`22`	`21`	`fromtypingimportOptional,Union`
`23`	`22`
`24`	`23`	`fromapp.translator.core.exceptions.coreimportSigmaRuleValidationException`

Comments

(0)