Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit77fe657

Browse files
authored
Merge pull request#50 from UncoderIO/rules_fixes
fix minor bugs in platforms rules
2 parents4a2237d +9202880 commit77fe657

File tree

8 files changed

+15
-13
lines changed

8 files changed

+15
-13
lines changed

‎translator/app/translator/core/exceptions/parser.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ class QueryParenthesesException(BaseParserException):
2323
def__init__(self):
2424
message= (
2525
"The query logic is broken. In the input, the numbers of opening and closing parentheses "
26-
"do not match. If you think there's no error, please contact us via GitHub."
26+
"do not match. If you think there's no error, please contact us."
2727
)
2828
super().__init__(message)
2929

‎translator/app/translator/core/models/parser_output.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ def __init__(
3535
self.severity=severityorSeverityType.low
3636
self.references=referencesor []
3737
self.tags=tagsor []
38-
self.mitre_attack=mitre_attackor[]
38+
self.mitre_attack=mitre_attackor{}
3939
self.status=statusor"stable"
4040
self.false_positives=false_positivesor []
4141
self.source_mapping_ids=source_mapping_idsor [DEFAULT_MAPPING_NAME]

‎translator/app/translator/platforms/elasticsearch/parsers/detection_rule.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,8 @@ def _parse_rule(self, text: str) -> dict:
3232
query=rule["query"]
3333
description=rule["description"]
3434
name=rule["name"]
35-
return {"query":query,"title":name,"description":description}
35+
query,logsources=self._parse_log_sources(query)
36+
return {"query":query,"title":name,"description":description,"logsources":logsources}
3637

3738
@staticmethod
3839
def_get_meta_info(source_mapping_ids:list[str],meta_info:dict)->MetaInfoContainer:
@@ -41,8 +42,8 @@ def _get_meta_info(source_mapping_ids: list[str], meta_info: dict) -> MetaInfoCo
4142
)
4243

4344
defparse(self,text:str)->SiemContainer:
44-
rule,log_sources=self._parse_rule(text)
45-
tokens,source_mappings=self.get_tokens_and_source_mappings(rule.get("query"),log_sources)
45+
rule=self._parse_rule(text)
46+
tokens,source_mappings=self.get_tokens_and_source_mappings(rule.get("query"),rule.get("log_sources", {}))
4647
returnSiemContainer(
4748
query=tokens,
4849
meta_info=self._get_meta_info(

‎translator/app/translator/platforms/logscale/parsers/logscale_alert.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ def _get_meta_info(source_mapping_ids: list[str], meta_info: dict) -> MetaInfoCo
4343
defparse(self,text:str)->SiemContainer:
4444
parsed_rule=self._parse_rule(text)
4545
query,functions=self._parse_query(query=parsed_rule.pop("query"))
46-
tokens,source_mappings=self.get_tokens_and_source_mappings(text, {})
46+
tokens,source_mappings=self.get_tokens_and_source_mappings(query, {})
4747
returnSiemContainer(
4848
query=tokens,
4949
meta_info=self._get_meta_info(

‎translator/app/translator/platforms/microsoft/renders/microsoft_sentinel_rule.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,10 +52,10 @@ def __create_mitre_threat(self, meta_info: MetaInfoContainer) -> tuple[list, lis
5252
tactics= []
5353
techniques= []
5454

55-
fortacticinmeta_info.mitre_attack.get("tactics"):
55+
fortacticinmeta_info.mitre_attack.get("tactics", []):
5656
tactics.append(tactic["tactic"])
5757

58-
fortechniqueinmeta_info.mitre_attack.get("techniques"):
58+
fortechniqueinmeta_info.mitre_attack.get("techniques", []):
5959
techniques.append(technique["technique_id"])
6060

6161
returntactics,techniques

‎translator/app/translator/platforms/splunk/parsers/splunk_alert.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,8 @@ class SplunkAlertParser(SplunkParser):
3030

3131
@staticmethod
3232
def_get_meta_info(source_mapping_ids:list[str],meta_info:Optional[str])->MetaInfoContainer:
33-
description=re.search(r"description\s*=\s*(?P<query>.+)",meta_info).group("description")
33+
description=re.search(r"description\s*=\s*(?P<query>.+)",meta_info).group()
34+
description=description.replace("description = ","")
3435
returnMetaInfoContainer(source_mapping_ids=source_mapping_ids,description=description)
3536

3637
defparse(self,text:str)->SiemContainer:
@@ -40,6 +41,6 @@ def parse(self, text: str) -> SiemContainer:
4041

4142
returnSiemContainer(
4243
query=tokens,
43-
meta_info=self._get_meta_info([source_mapping.source_idforsource_mappinginsource_mappings]),
44+
meta_info=self._get_meta_info([source_mapping.source_idforsource_mappinginsource_mappings],text),
4445
functions=functions,
4546
)

‎translator/app/translator/platforms/splunk/renders/splunk_alert.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ class SplunkAlertRender(SplunkQueryRender):
4343
def__create_mitre_threat(meta_info:MetaInfoContainer)->dict:
4444
techniques= {"mitre_attack": []}
4545

46-
fortechniqueinmeta_info.mitre_attack.get("techniques"):
46+
fortechniqueinmeta_info.mitre_attack.get("techniques", []):
4747
techniques["mitre_attack"].append(technique["technique_id"])
4848

4949
returntechniques

‎translator/app/translator/tools/decorators.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,13 @@ def exception_handler(*args, **kwargs) -> tuple[bool, str]:
1515
returnFalse,str(err)
1616
exceptExceptionaserr:
1717
print(f"Unexpected error.{err!s}")
18-
returnFalse,"Unexpected error. To resolve it, please, contact us via GitHub."
18+
returnFalse,"Unexpected error. To resolve it, please, contact us."
1919
else:
2020
ifresult:
2121
print("Translated successfully.")
2222
returnTrue,result
2323

2424
print("Unexpected error.")
25-
returnFalse,"Unexpected error. To resolve it, please, contact us via GitHub."
25+
returnFalse,"Unexpected error. To resolve it, please, contact us."
2626

2727
returnexception_handler

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp