valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 01:45:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add parentheses about field list groups in CB

Browse Source 
This should address the grouping issue from #660.
The grouping issue was solved by just slamming some parentheses around the fields in the listExpression field.
This commit is contained in:
Simen Lybekk 2020-06-11 14:28:22 +02:00
parent 97c45f9d46
commit bbcbed4742
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
tools/sigma/backends/carbonblack.py
View File

@ -54,7 +54,7 @@ class CarbonBlackQueryBackend(CarbonBlackWildcardHandlingMixin, SingleTextQueryB
orToken = " OR "
notToken = " -"
subExpression = "(%s)"
listExpression = "%s"
listExpression = "(%s)"
listSeparator = " OR "
valueExpression = '%s'
typedValueExpression = {