valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Implementing the fields to be selected

Browse Source
This commit is contained in:
Steven Goossens 2019-08-26 10:57:43 +00:00
parent 59a6a0c523
commit 895682aef2
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
tools/sigma/backends/qradar.py
View File

@ -175,7 +175,20 @@ class QRadarBackend(SingleTextQueryBackend):
aql_database = "flows" aql_database = "flows"
else: else:
aql_database = "events" aql_database = "events"
qradarPrefix = "SELECT UTF8(payload) as search_payload from %s where " % (aql_database)
qradarPrefix="SELECT "
try:
for field in sigmaparser.parsedyaml["fields"]:
mapped = sigmaparser.config.get_fieldmapping(field).resolve_fieldname(field)
#if type(mapped) == str:
# qradarPrefix += mapped +", "
#else:
# raise TypeError("Field mapping must return string or list")
qradarPrefix += str(sigmaparser.parsedyaml["fields"]).strip('[]')
qradarPrefix += " from %s where " % (aql_database)
except KeyError: # no 'fields' attribute
mapped = None
pass
try: try:
timeframe = sigmaparser.parsedyaml['detection']['timeframe'] timeframe = sigmaparser.parsedyaml['detection']['timeframe']