Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitbf008fe

Browse files
authored
Merge pull request#197 from UncoderIO/gis-8762
fix qradar logsource parsing
2 parents29fa729 +e142d2f commitbf008fe

File tree

6 files changed

+12
-8
lines changed

6 files changed

+12
-8
lines changed

‎uncoder-core/app/translator/mappings/platforms/qradar/linux_network_connection.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ log_source:
88

99
default_log_source:
1010
devicetype:11
11-
category:[4012]
11+
category:4012
1212

1313
field_mapping:
1414
CommandLine:Command

‎uncoder-core/app/translator/mappings/platforms/qradar/macos_network_connection.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ log_source:
88

99
default_log_source:
1010
devicetype:102
11-
category:[4012]
11+
category:4012
1212

1313
field_mapping:
1414
CommandLine:Command

‎uncoder-core/app/translator/mappings/platforms/qradar/windows_network_connection.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ log_source:
99

1010
default_log_source:
1111
devicetype:12
12-
category:[4012]
12+
category:4012
1313
qideventcategory:Microsoft-Windows-Sysmon/Operational
1414

1515
field_mapping:

‎uncoder-core/app/translator/platforms/base/aql/mapping.py‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,12 @@ def __str__(self) -> str:
3939
@property
4040
defextra_condition(self)->str:
4141
default_source=self._default_source
42-
return" AND ".join((f"{key}={value}"forkey,valueindefault_source.items()ifkey!="table"andvalue))
42+
extra= []
43+
forkey,valueindefault_source.items():
44+
ifkey!="table"andvalue:
45+
_condition=f"{key}={value}"ifisinstance(value,int)elsef"{key}='{value}'"
46+
extra.append(_condition)
47+
return" AND ".join(extra)
4348

4449

4550
classAQLMappings(BasePlatformMappings):
@@ -48,7 +53,7 @@ class AQLMappings(BasePlatformMappings):
4853

4954
defprepare_log_source_signature(self,mapping:dict)->AQLLogSourceSignature:
5055
log_source=mapping.get("log_source", {})
51-
default_log_source=mapping.get("default_log_source")
56+
default_log_source=mapping["default_log_source"]
5257
returnAQLLogSourceSignature(
5358
device_types=log_source.get("devicetype"),
5459
categories=log_source.get("category"),

‎uncoder-core/app/translator/platforms/base/aql/parsers/aql.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,13 +37,13 @@ class AQLQueryParser(PlatformQueryParser):
3737
log_source_functions= ("LOGSOURCENAME","LOGSOURCEGROUPNAME")
3838
log_source_function_pattern=r"\(?(?P<key>___func_name___\([a-zA-Z]+\))(?:\s+like\s+|\s+ilike\s+|\s*=\s*)'(?P<value>[%a-zA-Z\s]+)'\s*\)?\s+(?:and|or)?\s"# noqa: E501
3939

40-
log_source_key_types= ("devicetype","category","qid","qideventcategory",*LOG_SOURCE_FUNCTIONS_MAP.keys())
40+
log_source_key_types= ("devicetype","qideventcategory","category","qid",*LOG_SOURCE_FUNCTIONS_MAP.keys())
4141
log_source_pattern=rf"___source_type___(?:\s+like\s+|\s+ilike\s+|\s*=\s*)(?:{SINGLE_QUOTES_VALUE_PATTERN}|{NUM_VALUE_PATTERN})(?:\s+(?:and|or)\s+|\s+)?"# noqa: E501
4242
num_value_pattern=r"[0-9]+"
4343
multi_num_log_source_pattern= (
4444
rf"___source_type___\s+in\s+\((?P<value>(?:{num_value_pattern}(?:\s*,\s*)?)+)\)(?:\s+(?:and|or)\s+|\s+)?"
4545
)
46-
str_value_pattern=r"""(?:')(?P<s_q_value>(?:[:a-zA-Z\*0-9=+%#\-\/\\,_".$&^@!\(\)\{\}\s]|'')+)(?:')"""
46+
str_value_pattern=r"""'(?P<s_q_value>(?:[:a-zA-Z\*0-9=+%#\-\/\\,_".$&^@!\(\)\{\}\s]|'')+)'"""
4747
multi_str_log_source_pattern= (
4848
rf"""___source_type___\s+in\s+\((?P<value>(?:{str_value_pattern}(?:\s*,\s*)?)+)\)(?:\s+(?:and|or)\s+|\s+)?"""
4949
)

‎uncoder-core/app/translator/platforms/sigma/parsers/sigma.py‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818
"""
1919

2020
fromdatetimeimporttimedelta
21-
fromreimportI
2221
fromtypingimportOptional,Union
2322

2423
fromapp.translator.core.exceptions.coreimportSigmaRuleValidationException

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp