Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

fix minor bugs in platforms rules#50

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
UncoderIO merged 2 commits intomainfromrules_fixes
Jan 30, 2024
Merged
Show file tree
Hide file tree
Changes fromall commits
Commits
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletiontranslator/app/translator/core/exceptions/parser.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -23,7 +23,7 @@ class QueryParenthesesException(BaseParserException):
def __init__(self):
message = (
"The query logic is broken. In the input, the numbers of opening and closing parentheses "
"do not match. If you think there's no error, please contact us via GitHub."
"do not match. If you think there's no error, please contact us."
)
super().__init__(message)

Expand Down
2 changes: 1 addition & 1 deletiontranslator/app/translator/core/models/parser_output.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -35,7 +35,7 @@ def __init__(
self.severity=severityorSeverityType.low
self.references=referencesor []
self.tags=tagsor []
self.mitre_attack=mitre_attackor[]
self.mitre_attack=mitre_attackor{}
self.status=statusor"stable"
self.false_positives=false_positivesor []
self.source_mapping_ids=source_mapping_idsor [DEFAULT_MAPPING_NAME]
Expand Down
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -32,7 +32,8 @@ def _parse_rule(self, text: str) -> dict:
query = rule["query"]
description = rule["description"]
name = rule["name"]
return {"query": query, "title": name, "description": description}
query, logsources = self._parse_log_sources(query)
return {"query": query, "title": name, "description": description, "logsources": logsources}

@staticmethod
def _get_meta_info(source_mapping_ids: list[str], meta_info: dict) -> MetaInfoContainer:
Expand All@@ -41,8 +42,8 @@ def _get_meta_info(source_mapping_ids: list[str], meta_info: dict) -> MetaInfoCo
)

def parse(self, text: str) -> SiemContainer:
rule, log_sources = self._parse_rule(text)
tokens, source_mappings = self.get_tokens_and_source_mappings(rule.get("query"), log_sources)
rule = self._parse_rule(text)
tokens, source_mappings = self.get_tokens_and_source_mappings(rule.get("query"),rule.get("log_sources", {}))
return SiemContainer(
query=tokens,
meta_info=self._get_meta_info(
Expand Down
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -43,7 +43,7 @@ def _get_meta_info(source_mapping_ids: list[str], meta_info: dict) -> MetaInfoCo
defparse(self,text:str)->SiemContainer:
parsed_rule=self._parse_rule(text)
query,functions=self._parse_query(query=parsed_rule.pop("query"))
tokens,source_mappings=self.get_tokens_and_source_mappings(text, {})
tokens,source_mappings=self.get_tokens_and_source_mappings(query, {})
returnSiemContainer(
query=tokens,
meta_info=self._get_meta_info(
Expand Down
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -52,10 +52,10 @@ def __create_mitre_threat(self, meta_info: MetaInfoContainer) -> tuple[list, lis
tactics= []
techniques= []

fortacticinmeta_info.mitre_attack.get("tactics"):
fortacticinmeta_info.mitre_attack.get("tactics", []):
tactics.append(tactic["tactic"])

fortechniqueinmeta_info.mitre_attack.get("techniques"):
fortechniqueinmeta_info.mitre_attack.get("techniques", []):
techniques.append(technique["technique_id"])

returntactics,techniques
Expand Down
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -30,7 +30,8 @@ class SplunkAlertParser(SplunkParser):

@staticmethod
def _get_meta_info(source_mapping_ids: list[str], meta_info: Optional[str]) -> MetaInfoContainer:
description = re.search(r"description\s*=\s*(?P<query>.+)", meta_info).group("description")
description = re.search(r"description\s*=\s*(?P<query>.+)", meta_info).group()
description = description.replace("description = ", "")
return MetaInfoContainer(source_mapping_ids=source_mapping_ids, description=description)

def parse(self, text: str) -> SiemContainer:
Expand All@@ -40,6 +41,6 @@ def parse(self, text: str) -> SiemContainer:

return SiemContainer(
query=tokens,
meta_info=self._get_meta_info([source_mapping.source_id for source_mapping in source_mappings]),
meta_info=self._get_meta_info([source_mapping.source_id for source_mapping in source_mappings], text),
functions=functions,
)
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -43,7 +43,7 @@ class SplunkAlertRender(SplunkQueryRender):
def __create_mitre_threat(meta_info: MetaInfoContainer) -> dict:
techniques = {"mitre_attack": []}

for technique in meta_info.mitre_attack.get("techniques"):
for technique in meta_info.mitre_attack.get("techniques", []):
techniques["mitre_attack"].append(technique["technique_id"])

return techniques
Expand Down
4 changes: 2 additions & 2 deletionstranslator/app/translator/tools/decorators.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -15,13 +15,13 @@ def exception_handler(*args, **kwargs) -> tuple[bool, str]:
return False, str(err)
except Exception as err:
print(f"Unexpected error. {err!s}")
return False, "Unexpected error. To resolve it, please, contact us via GitHub."
return False, "Unexpected error. To resolve it, please, contact us."
else:
if result:
print("Translated successfully.")
return True, result

print("Unexpected error.")
return False, "Unexpected error. To resolve it, please, contact us via GitHub."
return False, "Unexpected error. To resolve it, please, contact us."

return exception_handler
[8]ページ先頭
©2009-2025 Movatter.jp