Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitc1dddc7

Browse files
committed
merge prod into gis-8036
1 parent0c9b2a0 commitc1dddc7

File tree

9 files changed

+53
-19
lines changed

9 files changed

+53
-19
lines changed

‎uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/dns.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,4 @@ field_mapping:
1111
dns_query_name:xdm.network.dns.dns_question.name
1212
QueryName:xdm.network.dns.dns_question.name
1313
query:xdm.network.dns.dns_question.name
14-
dns-record-type:xdm.network.dns.dns_question.type
14+
dns-record-type:xdm.network.dns.dns_question.type

‎uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/linux_process_creation.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,4 +26,5 @@ field_mapping:
2626
ParentProduct:actor_process_signature_product
2727
ParentCompany:actor_process_signature_vendor
2828
md5:action_process_image_md5
29-
sha256:action_process_image_sha256
29+
sha256:action_process_image_sha256
30+
EventID:action_evtlog_event_id

‎uncoder-core/app/translator/mappings/platforms/qradar/default.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,9 @@ field_mapping:
5959
-dst-packets
6060
src-bytes:src-bytes
6161
dst-bytes:dst-bytes
62-
ExternalSeverity:External Severity
62+
ExternalSeverity:
63+
-External Severity
64+
-Observeit Severity
6365
SourceMAC:
6466
-SourceMAC
6567
-MAC
@@ -73,6 +75,6 @@ field_mapping:
7375
SourceUserName:SourceUserName
7476
url_category:XForceCategoryByURL
7577
EventSeverity:EventSeverity
76-
Source:
78+
Source:
7779
-Source
78-
-source
80+
-source

‎uncoder-core/app/translator/mappings/platforms/qradar/firewall.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,13 @@ default_log_source:
1111
field_mapping:
1212
src-ip:
1313
-sourceip
14+
-sourceIP
15+
-SourceIP
1416
-SrcHost
1517
-LocalHost
1618
-Source
1719
-NetworkView
20+
-HostName
1821
src-port:
1922
-sourceport
2023
-SrcPort

‎uncoder-core/app/translator/mappings/platforms/qradar/linux_process_creation.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,12 @@ default_log_source:
1111
category:8110
1212

1313
field_mapping:
14-
CommandLine:Command
14+
CommandLine:
15+
-Command
16+
-ASACommand
1517
Image:Process Path
1618
ParentCommandLine:Parent Command
1719
ParentImage:Parent Process Path
1820
User:username
19-
LogonId:Logon ID
21+
LogonId:Logon ID
22+
EventID:ASASyslogCode

‎uncoder-core/app/translator/mappings/platforms/qradar/windows_process_creation.yml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,20 @@ default_log_source:
1111
category:8110
1212

1313
field_mapping:
14-
CommandLine:Command
14+
CommandLine:
15+
-Command
16+
-Encoded Argument
1517
CurrentDirectory:CurrentDirectory
1618
Hashes:File Hash
17-
Image:Process Path
19+
Image:
20+
-Process Path
21+
-Process Name
22+
-DGApplication
1823
IntegrityLevel:IntegrityLevel
1924
ParentCommandLine:Parent Command
2025
ParentImage:Parent Process Path
2126
ParentUser:ParentUser
2227
Product:Product
23-
User:username
28+
User:
29+
-username
30+
-userName

‎uncoder-core/app/translator/mappings/platforms/qradar/windows_process_termination.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ default_log_source:
1111
category:8113
1212

1313
field_mapping:
14-
Image:Process Path
14+
Image:
15+
-Process Path
16+
-Terminated Process Name
1517
ProcessId:ProcessId
1618
# ProcessGuid: ProcessGuid

‎uncoder-core/app/translator/mappings/platforms/qradar/windows_security.yml‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,9 @@ default_log_source:
99
devicetype:12
1010

1111
field_mapping:
12-
EventID:Event ID
12+
EventID:
13+
-Event ID
14+
-EventID
1315
ParentImage:Parent Process Path
1416
AccessMask:AccessMask
1517
AccountName:Account Name
@@ -22,13 +24,16 @@ field_mapping:
2224
ComputerName:
2325
-Machine Identifier
2426
-Hostname
27+
-identityNetBiosName
2528
EventType:EventType
2629
FailureReason:FailureReason
2730
FileName:Filename
2831
GrantedAccess:GrantedAccess
2932
Hashes:File Hash
3033
HiveName:HiveName
31-
IpAddress:
34+
IpAddress:
35+
-sourceIP
36+
-SourceIP
3237
-sourceip
3338
-identityIP
3439
IpPort:sourceport
@@ -45,7 +50,7 @@ field_mapping:
4550
-Process Name
4651
-New Process Name
4752
ObjectClass:ObjectClass
48-
ObjectName:
53+
ObjectName:
4954
-Object Name
5055
-objectname
5156
-MSFileObjectName
@@ -76,6 +81,7 @@ field_mapping:
7681
GroupMembership:
7782
-GroupMembership
7883
-GroupName
84+
-Group Name
7985
FilterName:FilterName
8086
ChangeType:ChangeType
8187
LayerName:LayerName
@@ -95,7 +101,9 @@ field_mapping:
95101
TargetServerName:TargetServerName
96102
NewTargetUserName:NewTargetUserName
97103
OperationType:OperationType
98-
DestPort:destinationport
104+
DestPort:
105+
-destinationport
106+
-DstPort
99107
ServiceStartType:ServiceStartType
100108
OldTargetUserName:OldTargetUserName
101109
UserPrincipalName:UserPrincipalName
@@ -104,7 +112,10 @@ field_mapping:
104112
DisableIntegrityChecks:DisableIntegrityChecks
105113
AuditSourceName:AuditSourceName
106114
Workstation:Machine Identifier
107-
DestAddress:destinationip
115+
DestAddress:
116+
-destinationip
117+
-DestinationIP
118+
-destinationaddress
108119
PreAuthType:PreAuthType
109120
SecurityPackageName:SecurityPackageName
110121
SubjectLogonId:SubjectLogonId
@@ -150,6 +161,8 @@ field_mapping:
150161
TargetSid:TargetSid
151162
TargetUserName:
152163
-Target Username
164+
-User
165+
-userName
153166
-Target User Name
154167
ObjectServer:ObjectServer
155168
TargetUserSid:TargetUserSid

‎uncoder-core/app/translator/platforms/palo_alto/renders/cortex_xsiam.py‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,6 @@
5050
}
5151

5252

53-
5453
classCortexXQLFieldValueRender(BaseFieldValueRender):
5554
details:PlatformDetails=cortex_xql_query_details
5655
str_value_manager=cortex_xql_str_value_manager
@@ -72,7 +71,7 @@ def _wrap_str_value(value: str) -> str:
7271
defequal_modifier(self,field:str,value:DEFAULT_VALUE_TYPE)->str:
7372
ifisinstance(value,list):
7473
values=", ".join(
75-
f"{self._pre_process_value(field,v,value_type=ValueType.value,wrap_str=True)}"forvinvalue
74+
f"{self._pre_process_value(field,str(v),value_type=ValueType.value,wrap_str=True)}"forvinvalue
7675
)
7776
returnf"{field} in ({values})"
7877

@@ -123,7 +122,11 @@ def startswith_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
123122
defregex_modifier(self,field:str,value:DEFAULT_VALUE_TYPE)->str:
124123
ifisinstance(value,list):
125124
returnf"({self.or_token.join(self.regex_modifier(field=field,value=v)forvinvalue)})"
126-
returnf"{field} ~={self._pre_process_value(field ,value,value_type=ValueType.regex_value,wrap_str=True)}"
125+
value=self._pre_process_value(field,value,value_type=ValueType.regex_value,wrap_str=True)
126+
ifvalue.endswith('\\\\"'):
127+
value=value[:-1]+"]"+value[-1:]
128+
value=value[:-4]+"["+value[-4:]
129+
returnf"{field} ~={value}"
127130

128131
defnot_regex_modifier(self,field:str,value:DEFAULT_VALUE_TYPE)->str:
129132
ifisinstance(value,list):

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp