NotificationsYou must be signed in to change notification settings
Fork33
Star165

Commita033392

committed

gis-9137 add sigma cti render

1 parent3e2c071 commita033392Copy full SHA for a033392

File tree

87 files changed

+413

-319

lines changed

uncoder-core/app
- routers
  - ioc_translate.py
- translator
  - cti_translator.py
  - platforms
    - arcsight
      - const.py
      - mappings
        __init__.py
        arcsight_cti.py
      - renders
        arcsight_cti.py
    - athena
      - const.py
      - mappings
        __init__.py
        athena_cti.py
      - renders
        athena_cti.py
    - carbonblack
      - const.py
      - mappings
        __init__.py
        carbonblack_cti.py
      - renders
        carbonblack_cti.py
    - chronicle
      - const.py
      - mappings
        __init__.py
        chronicle_cti.py
      - renders
        chronicle_cti.py
    - crowdstrike
      - const.py
      - mappings
        __init__.py
        crowdstrike_cti.py
      - renders
        crowdstrike_cti.py
    - elasticsearch
      - const.py
      - mappings
        __init__.py
        elasticsearch_cti_cti.py
      - renders
        elasticsearch_cti.py
    - fireeye_helix
      - const.py
      - mappings
        __init__.py
        fireeye_helix.py
      - renders
        fireeye_helix_cti.py
    - graylog
      - const.py
      - mappings
        __init__.py
        graylog_cti.py
      - renders
        graylog_cti.py
    - logpoint
      - const.py
      - mappings
        __init__.py
        logpoint_cti.py
      - renders
        logpoint_cti.py
    - logscale
      - const.py
      - mappings
        __init__.py
        logscale_cti.py
      - renders
        logscale_cti.py
    - microsoft
      - const.py
      - mappings
        __init__.py
        mdatp_cti.py
        microsoft_sentinel_cti.py
      - renders
        microsoft_defender_cti.py
        microsoft_sentinel_cti.py
    - opensearch
      - const.py
      - mappings
        __init__.py
        opensearch_cti.py
      - renders
        opensearch_cti.py
    - qradar
      - const.py
      - mappings
        __init__.py
        qradar_cti.py
      - renders
        qradar_cti.py
    - qualys
      - const.py
      - mappings
        __init__.py
        qualys_cti.py
      - renders
        qualys_cti.py
    - rsa_netwitness
      - const.py
      - mappings
        __init__.py
        rsa_netwitness_cti.py
      - renders
        rsa_netwitness_cti.py
    - securonix
      - const.py
      - mappings
        __init__.py
        securonix_cti.py
      - renders
        securonix_cti.py
    - sentinel_one
      - const.py
      - mappings
        __init__.py
        s1_cti.py
      - renders
        s1_cti.py
    - sigma
      - __init__.py
      - const.py
      - renders
        sigma_cti.py
    - snowflake
      - const.py
      - mappings
        __init__.py
        snowflake_cti.py
      - renders
        snowflake_cti.py
    - splunk
      - const.py
      - mappings
        __init__.py
        splunk_cti.py
      - renders
        splunk_cti.py
    - sumo_logic
      - const.py
      - mappings
        __init__.py
        sumologic_cti.py
      - renders
        sumologic_cti.py

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

87 files changed

+413

-319

lines changed

`‎uncoder-core/app/routers/ioc_translate.py‎`

Lines changed: 1 addition & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -4,11 +4,10 @@`
`4`	`4`
`5`	`5`	`fromapp.models.ioc_translationimportCTIPlatform,OneTranslationCTIData`
`6`	`6`	`fromapp.models.translationimportInfoMessage`
`7`		`-fromapp.translator.cti_translatorimportCTITranslator`
	`7`	`+fromapp.translator.cti_translatorimportcti_translator`
`8`	`8`	`fromapp.translator.tools.constimportHashType,IocParsingRule,IOCType`
`9`	`9`
`10`	`10`	`iocs_router=APIRouter()`
`11`		`-cti_translator=CTITranslator()`
`12`	`11`
`13`	`12`
`14`	`13`	`@iocs_router.post("/iocs/translate",description="Parse IOCs from text.")`

`‎uncoder-core/app/translator/cti_translator.py‎`

Lines changed: 3 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -86,3 +86,6 @@ def __get_iocs_chunk(`
`86`	`86`	`@classmethod`
`87`	`87`	`defget_renders(cls)->list:`
`88`	`88`	`returncls.render_manager.get_platforms_details`
	`89`	`+`
	`90`	`+`
	`91`	`+cti_translator=CTITranslator()`

`‎uncoder-core/app/translator/platforms/arcsight/const.py‎`

Lines changed: 14 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -6,3 +6,17 @@`
`6`	`6`	`"platform_name":"Query",`
`7`	`7`	`"alt_platform_name":"CEF",`
`8`	`8`	`}`
	`9`	`+`
	`10`	`+`
	`11`	`+DEFAULT_ARCSIGHT_CTI_MAPPING= {`
	`12`	`+"SourceIP":"sourceAddress",`
	`13`	`+"DestinationIP":"destinationAddress",`
	`14`	`+"Domain":"destinationDnsDomain",`
	`15`	`+"URL":"requestUrl",`
	`16`	`+"HashMd5":"fileHash",`
	`17`	`+"HashSha1":"fileHash",`
	`18`	`+"HashSha256":"fileHash",`
	`19`	`+"HashSha512":"fileHash",`
	`20`	`+"Emails":"sender-address",`
	`21`	`+"Files":"winlog.event_data.TargetFilename",`
	`22`	`+}`

`‎uncoder-core/app/translator/platforms/arcsight/mappings/init.py‎`

Whitespace-only changes.

`‎uncoder-core/app/translator/platforms/arcsight/mappings/arcsight_cti.py‎`

Lines changed: 0 additions & 12 deletions

This file was deleted.

`‎uncoder-core/app/translator/platforms/arcsight/renders/arcsight_cti.py‎`

Lines changed: 2 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -1,15 +1,14 @@`
`1`	`1`	`fromapp.translator.core.models.platform_detailsimportPlatformDetails`
`2`	`2`	`fromapp.translator.core.render_ctiimportRenderCTI`
`3`	`3`	`fromapp.translator.managersimportrender_cti_manager`
`4`		`-fromapp.translator.platforms.arcsight.constimportARCSIGHT_QUERY_DETAILS`
`5`		`-fromapp.translator.platforms.arcsight.mappings.arcsight_ctiimportDEFAULT_ARCSIGHT_MAPPING`
	`4`	`+fromapp.translator.platforms.arcsight.constimportARCSIGHT_QUERY_DETAILS,DEFAULT_ARCSIGHT_CTI_MAPPING`
`6`	`5`
`7`	`6`
`8`	`7`	`@render_cti_manager.register`
`9`	`8`	`classArcsightKeyword(RenderCTI):`
`10`	`9`	`details:PlatformDetails=PlatformDetails(**ARCSIGHT_QUERY_DETAILS)`
`11`	`10`
`12`		`-default_mapping=DEFAULT_ARCSIGHT_MAPPING`
	`11`	`+default_mapping=DEFAULT_ARCSIGHT_CTI_MAPPING`
`13`	`12`	`field_value_template:str="{key} = {value}"`
`14`	`13`	`or_operator:str=" OR "`
`15`	`14`	`group_or_operator:str=" OR "`

`‎uncoder-core/app/translator/platforms/athena/const.py‎`

Lines changed: 14 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -9,4 +9,18 @@`
`9`	`9`	`"alt_platform_name":"OCSF",`
`10`	`10`	`}`
`11`	`11`
	`12`	`+DEFAULT_ATHENA_CTI_MAPPING= {`
	`13`	`+"SourceIP":"src_endpoint",`
	`14`	`+"DestinationIP":"dst_endpoint",`
	`15`	`+"Domain":"dst_endpoint",`
	`16`	`+"URL":"http_request",`
	`17`	`+"HashMd5":"unmapped.file.hash.md5",`
	`18`	`+"HashSha1":"unmapped.file.hash.sha1",`
	`19`	`+"HashSha256":"unmapped.file.hash.sha256",`
	`20`	`+"HashSha512":"unmapped.file.hash.sha512",`
	`21`	`+"Email":"email",`
	`22`	`+"FileName":"file.name",`
	`23`	`+}`
	`24`	`+`
	`25`	`+`
`12`	`26`	`athena_query_details=PlatformDetails(**ATHENA_QUERY_DETAILS)`

`‎uncoder-core/app/translator/platforms/athena/mappings/init.py‎`

Whitespace-only changes.

`‎uncoder-core/app/translator/platforms/athena/mappings/athena_cti.py‎`

Lines changed: 0 additions & 12 deletions

This file was deleted.

`‎uncoder-core/app/translator/platforms/athena/renders/athena_cti.py‎`

Lines changed: 2 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -20,8 +20,7 @@`
`20`	`20`	`fromapp.translator.core.models.platform_detailsimportPlatformDetails`
`21`	`21`	`fromapp.translator.core.render_ctiimportRenderCTI`
`22`	`22`	`fromapp.translator.managersimportrender_cti_manager`
`23`		`-fromapp.translator.platforms.athena.constimportathena_query_details`
`24`		`-fromapp.translator.platforms.athena.mappings.athena_ctiimportDEFAULT_ATHENA_MAPPING`
	`23`	`+fromapp.translator.platforms.athena.constimportDEFAULT_ATHENA_CTI_MAPPING,athena_query_details`
`25`	`24`
`26`	`25`
`27`	`26`	`@render_cti_manager.register`
`@@ -35,4 +34,4 @@ class AthenaCTI(RenderCTI):`
`35`	`34`	`result_join:str=""`
`36`	`35`	`final_result_for_many:str="SELECT * from eventlog where {result}\n"`
`37`	`36`	`final_result_for_one:str="SELECT * from eventlog where {result}\n"`
`38`		`-default_mapping=DEFAULT_ATHENA_MAPPING`
	`37`	`+default_mapping=DEFAULT_ATHENA_CTI_MAPPING`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commita033392

File tree

87 files changed

Some content is hidden

87 files changed

`‎uncoder-core/app/routers/ioc_translate.py‎`

`‎uncoder-core/app/translator/cti_translator.py‎`

`‎uncoder-core/app/translator/platforms/arcsight/const.py‎`

`‎uncoder-core/app/translator/platforms/arcsight/mappings/init.py‎`

`‎uncoder-core/app/translator/platforms/arcsight/mappings/arcsight_cti.py‎`

`‎uncoder-core/app/translator/platforms/arcsight/renders/arcsight_cti.py‎`

`‎uncoder-core/app/translator/platforms/athena/const.py‎`

`‎uncoder-core/app/translator/platforms/athena/mappings/init.py‎`

`‎uncoder-core/app/translator/platforms/athena/mappings/athena_cti.py‎`

`‎uncoder-core/app/translator/platforms/athena/renders/athena_cti.py‎`

0 commit comments