Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

gis-9284 add strict mapping to Anomali#221

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
nazargesyk merged 1 commit intomainfromgis-9284
Dec 17, 2024
Merged
Show file tree
Hide file tree
Changes fromall commits
Commits
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,19 @@
platform:Anomali
description:Common field mapping
source:proxy

field_mapping:
c-uri-query:url
c-useragent:user_agent
c-uri:url
cs-method:http_method
cs-bytes:bytes_out
cs-referrer:http_referrer
sc-status:return_code

dns-query:query
dns-answer:answer
dns-record:record_type

CommandLine:command_line
DestinationHostname:dest
DestinationIp:dest_ip
Expand Down
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
platform: Anomali
source: webserver

field_mapping:
c-uri-query: url
c-useragent: user_agent
c-uri: url
cs-method: http_method
cs-bytes: bytes_out
cs-referrer: http_referrer
sc-status: return_code

dns-query: query
dns-answer: answer
dns-record: record_type

CommandLine: command_line
DestinationHostname: dest
DestinationIp: dest_ip
DestinationPort: dest_port
Details: reg_value_data
dst_ip: dest_ip
dst_port: dest_port
EventID: event_id
EventName: event_name
FileName: file_name
FilePath: file_path
Image: image
NewProcessName: image
OriginalFileName: original_file_name
ParentCommandLine: parent_command_line
ParentImage: parent_image
ParentProcessID: parent_process_id
Platform: platform
ProcessCommandLine: command_line
ProcessID: process_id
SourceImage: parent_image
SourcePort: src_port
TargetFilename: file_name
TargetObject: reg_key
UserAgent: user_agent
4 changes: 2 additions & 2 deletionsuncoder-core/app/translator/platforms/anomali/mapping.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
from app.translator.core.mapping importBaseCommonPlatformMappings, LogSourceSignature
from app.translator.core.mapping importBaseStrictLogSourcesPlatformMappings, LogSourceSignature
from app.translator.platforms.anomali.const import anomali_query_details


Expand All@@ -10,7 +10,7 @@ def __str__(self) -> str:
return ""


class AnomaliMappings(BaseCommonPlatformMappings):
class AnomaliMappings(BaseStrictLogSourcesPlatformMappings):
def prepare_log_source_signature(self, mapping: dict) -> AnomaliLogSourceSignature: # noqa: ARG002
return AnomaliLogSourceSignature()

Expand Down
Loading
[8]ページ先頭
©2009-2025 Movatter.jp