stix-shifter icon indicating copy to clipboard operation
stix-shifter copied to clipboard

Splunk Connector network-traffic:dst_ref.value translates dst_ref.value into "src" when it should be dest_ip or dest

Open tavalkyansant opened this issue 3 years ago • 1 comments

stix-shifter translate splunk query "{}" "[url:value = 'http://www.testaddress.com/'] OR [network-traffic:dst_ref.value = '192.168.122.84']"
 2022-08-08 15:51:31,571 stix_shifter_modules.splunk.stix_translation.query_translator INFO     Converting STIX2 Pattern to Splunk query
{
    "queries": [
        "search (url = \"http://www.testaddress.com/\") OR (src = \"192.168.122.84\") earliest=\"-5minutes\" | head 10000 | fields src_ip, src_port, src_mac, src_ipv6, dest_ip, dest_port, dest_mac, dest_ipv6, file_hash, user, url, protocol, host, source, DeviceType, Direction, severity, EventID, EventName, ss_name, TacticId, Tactic, TechniqueId, Technique, process, process_id, process_name, process_exec, process_path, process_hash, parent_process, parent_process_id, parent_process_name, parent_process_exec, description, result, signature, signature_id, query, answer"

https://github.com/opencybersecurityalliance/stix-shifter/blob/2250c474cda99783dac83fca3b69d60f362d9433/stix_shifter_modules/splunk/stix_translation/json/stix_2_1/from_stix_map.json#L95


    "network-traffic": {
        "cim_type": "network",
        "fields": {
            "src_ref.value": "src",
            "src_port": "src_port",
            "dst_ref.value": "src",
            "dst_port": "dest_port",
            "protocols[*]": "protocol",
            "start": "earliest",
            "end": "latest"
        }

image

tavalkyansant avatar Aug 08 '22 15:08 tavalkyansant

Duplicate of https://github.com/opencybersecurityalliance/stix-shifter/issues/919

pcoccoli avatar Aug 08 '22 16:08 pcoccoli