Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

crowdstrike connector does not support LIKE #1204

Open
pcoccoli opened this issue Nov 22, 2022 · 0 comments
Open

crowdstrike connector does not support LIKE #1204

pcoccoli opened this issue Nov 22, 2022 · 0 comments
Labels
bug Something isn't working

Comments

@pcoccoli
Copy link
Contributor

Describe the bug
crowdstrike connector does not support LIKE but FQL supports wildcards; see https://falconpy.io/Usage/Falcon-Query-Language.html#operators

To Reproduce
Steps to reproduce the behavior:

  1. python main.py translate crowdstrike query '{}' "[process:name LIKE '%']"

Expected behavior
It should work

Screenshots

$ python main.py translate crowdstrike query '{}' "[process:name LIKE '%']"
 2022-11-22 15:42:27,637 stix_shifter.stix_translation.stix_translation ERROR    Caught exception: Unable to map the following STIX Operators: [Like] to data source fields <class 'stix_shifter_utils.stix_translation.src.utils.exceptions.DataMappingException'>
 2022-11-22 15:42:27,638 stix_shifter_utils.stix_translation.stix_translation_error_mapper ERROR    received exception => DataMappingException: Unable to map the following STIX Operators: [Like] to data source fields
{
    "success": false,
    "connector": "crowdstrike",
    "code": "mapping_error",
    "error": "crowdstrike connector error => data mapping error : Unable to map the following STIX Operators: [Like] to data source fields"
}

Additional context
develop branch, commit 01b18cb

@pcoccoli pcoccoli added the bug Something isn't working label Nov 22, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant