Commit50dd41b

committed

splunk fixes

1 parentc2ee977 commit50dd41bCopy full SHA for 50dd41b

File tree

-4

lines changed

siem-converter/app/converter/backends/splunk
- parsers
  - splunk.py
- tokenizer.py

-4

lines changed

Lines changed: 2 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -45,8 +45,8 @@ def _parse_log_sources(self, query: str) -> Tuple[Dict[str, List[str]], str]:`
`45`	`45`	`log_sources.setdefault(source_type, [])`
`46`	`46`	`pattern=self.log_source_pattern.replace('___source_type___',source_type)`
`47`	`47`	`whilesearch:=re.search(pattern,query,flags=re.IGNORECASE):`
`48`		`-results=search.groupdict()`
`49`		`-value=results.get("value")`
	`48`	`+group_dict=search.groupdict()`
	`49`	`+value=group_dict.get("d_q_value")orgroup_dict.get("value")`
`50`	`50`	`log_sources.setdefault(source_type, []).append(value)`
`51`	`51`	`pos_start=search.start()`
`52`	`52`	`pos_end=search.end()`

Lines changed: 6 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -29,8 +29,9 @@ class SplunkTokenizer(QueryTokenizer):`
`29`	`29`	`num_value_pattern=r"(?P<num_value>\d+(?:\.\d+))\s"`
`30`	`30`	`double_quotes_value_pattern=r'"(?P<d_q_value>(?:[:a-zA-Z\0-9=+%#\-_/,\'\.$&^@!\{\}\s]\|\\\"\|\\))"\s*'`
`31`	`31`	`single_quotes_value_pattern=r"'(?P<s_q_value>(?:[:a-zA-Z\0-9=+%#\-_/,\"\.$&^@!\{\}\s]\|\\\'\|\\))'\s*"`
`32`		`-_value_pattern=fr"{num_value_pattern}\|{double_quotes_value_pattern}\|{single_quotes_value_pattern}"`
`33`		`-multi_value_pattern=r"""$(?P<value>[:a-zA-Z\"\0-9=+%#\-_\/\\'\,.&^@!\(\s])$"""`
	`32`	`+no_quotes_value=r"(?P<no_q_value>(?:[:a-zA-Z\0-9=+%#\-_/,\.\\$&^@!])+)\s"`
	`33`	`+_value_pattern=fr"{num_value_pattern}\|{no_quotes_value}\|{double_quotes_value_pattern}\|{single_quotes_value_pattern}"`
	`34`	`+multi_value_pattern=r"""$(?P<value>[:a-zA-Z\"\*0-9=+%#\-_\/\\'\,.&^@!\(\s]+)$"""`
`34`	`35`	`keyword_pattern=double_quotes_value_pattern`
`35`	`36`
`36`	`37`	`multi_value_operators= ("in",)`
`@@ -40,6 +41,9 @@ def get_operator_and_value(self, match: re.Match, operator: str = OperatorType.E`
`40`	`41`	`ifnum_value:=get_match_group(match,group_name='num_value'):`
`41`	`42`	`returnoperator,num_value`
`42`	`43`
	`44`	`+elifno_q_value:=get_match_group(match,group_name='no_q_value'):`
	`45`	`+returnoperator,no_q_value`
	`46`	`+`
`43`	`47`	`elifd_q_value:=get_match_group(match,group_name='d_q_value'):`
`44`	`48`	`returnoperator,d_q_value`
`45`	`49`

Comments

(0)