Commitd1efabf

authored

Merge pull request#219 from UncoderIO/gis-9195

Gis 9195 fix sentinel one power query regex escaping

2 parentsc51fb74 +de542e9 commitd1efabfCopy full SHA for d1efabf

File tree

-3

lines changed

uncoder-core/app/translator/platforms
- microsoft/renders
  - microsoft_sentinel_rule.py
- sentinel_one/renders
  - sentinel_one_power_query.py

-3

lines changed

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -105,7 +105,7 @@ def finalize_query(`
`105`	`105`	`not_supported_functions:Optional[list]=None,`
`106`	`106`	`unmapped_fields:Optional[list[str]]=None,`
`107`	`107`	`*args,# noqa: ARG002`
`108`		`-**kwargs,# noqa: ARG002`
	`108`	`+**kwargs,`
`109`	`109`	`)->str:`
`110`	`110`	`ifnotkwargs.get("raw_query",False):`
`111`	`111`	`query=super().finalize_query(prefix=prefix,query=query,functions=functions)`

Lines changed: 5 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -65,7 +65,7 @@ def contains_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:`
`65`	`65`	`forvinvalue`
`66`	`66`	`)`
`67`	`67`	`returnf"{field} contains ({values})"`
`68`		`-value=self._pre_process_value(field,value,value_type=ValueType.value)`
	`68`	`+value=self._pre_process_value(field,value,value_type=ValueType.value,wrap_str=True,wrap_int=True)`
`69`	`69`	`returnf"{field} contains{value}"`
`70`	`70`
`71`	`71`	`defendswith_modifier(self,field:str,value:DEFAULT_VALUE_TYPE)->str:`
`@@ -77,11 +77,14 @@ def startswith_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:`
`77`	`77`	`defregex_modifier(self,field:str,value:DEFAULT_VALUE_TYPE)->str:`
`78`	`78`	`ifisinstance(value,list):`
`79`	`79`	`values=self.list_token.join(`
`80`		`-self._pre_process_value(field,v,value_type=ValueType.regex_value,wrap_str=True,wrap_int=True)`
	`80`	`+self.str_value_manager.escape_manager.escape(`
	`81`	`+self._pre_process_value(field,v,value_type=ValueType.regex_value,wrap_str=True,wrap_int=True)`
	`82`	`+ )`
`81`	`83`	`forvinvalue`
`82`	`84`	`)`
`83`	`85`	`returnf"{field} matches ({values})"`
`84`	`86`	`value=self._pre_process_value(field,value,value_type=ValueType.regex_value,wrap_str=True,wrap_int=True)`
	`87`	`+value=self.str_value_manager.escape_manager.escape(value)`
`85`	`88`	`returnf"{field} matches{value}"`
`86`	`89`
`87`	`90`	`defis_none(self,field:str,value:DEFAULT_VALUE_TYPE)->str:# noqa: ARG002`

Comments

(0)