Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Gis 7956#162

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
tarnopolskyi merged 7 commits intomainfromgis-7956
Jun 27, 2024
Merged
Show file tree
Hide file tree
Changes fromall commits
Commits
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletionsuncoder-core/app/translator/core/models/field.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -60,6 +60,11 @@ def value(self) -> Union[int, str, StrValue, list[Union[int, str, StrValue]]]:
return self.values[0]
return self.values

@value.setter
def value(self, new_value: Union[int, str, StrValue, list[Union[int, str, StrValue]]]) -> None:
self.values = []
self.__add_value(new_value)

def __add_value(self, value: Optional[Union[int, str, StrValue, list, tuple]]) -> None:
if value and isinstance(value, (list, tuple)):
for v in value:
Expand Down
Original file line numberDiff line numberDiff line change
Expand Up@@ -28,4 +28,5 @@ field_mapping:
ParentIntegrityLevel: causality_actor_process_integrity_level
ParentLogonId: causality_actor_process_logon_id
ParentProduct: causality_actor_process_signature_product
ParentCompany: causality_actor_process_signature_vendor
ParentCompany: causality_actor_process_signature_vendor
EventType: event_sub_type
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -21,6 +21,9 @@

from app.translator.const import DEFAULT_VALUE_TYPE
from app.translator.core.custom_types.values import ValueType
from app.translator.core.mapping import SourceMapping
from app.translator.core.models.field import FieldValue, Keyword
from app.translator.core.models.identifier import Identifier
from app.translator.core.models.platform_details import PlatformDetails
from app.translator.core.render import BaseQueryFieldValue, PlatformQueryRender
from app.translator.core.str_value_manager import StrValue
Expand All@@ -34,6 +37,16 @@
)
from app.translator.platforms.palo_alto.str_value_manager import cortex_xql_str_value_manager

SOURCE_MAPPING_TO_FIELD_VALUE_MAP = {
"windows_registry_event": {
"EventType": {
"SetValue": "REGISTRY_SET_VALUE",
"DeleteValue": "REGISTRY_DELETE_VALUE",
"CreateKey": "REGISTRY_CREATE_KEY",
}
}
}


class CortexXQLFieldValue(BaseQueryFieldValue):
details: PlatformDetails = cortex_xql_query_details
Expand DownExpand Up@@ -173,6 +186,19 @@ def generate_prefix(self, log_source_signature: CortexXQLLogSourceSignature, fun
functions_prefix = f"{functions_prefix} | " if functions_prefix else ""
return f"{functions_prefix}{log_source_signature}"

def apply_token(self, token: Union[FieldValue, Keyword, Identifier], source_mapping: SourceMapping) -> str:
if isinstance(token, FieldValue):
field_name = token.field.source_name
if values_map := SOURCE_MAPPING_TO_FIELD_VALUE_MAP.get(source_mapping.source_id, {}).get(field_name):
values_to_update = []
for token_value in token.values:
mapped_value: str = values_map.get(token_value, token_value)
values_to_update.append(
StrValue(value=mapped_value, split_value=mapped_value.split()) if mapped_value else token_value
)
token.value = values_to_update
return super().apply_token(token=token, source_mapping=source_mapping)

@staticmethod
def _finalize_search_query(query: str) -> str:
return f"| filter {query}" if query else ""
[8]ページ先頭
©2009-2025 Movatter.jp