stix-shifter
stix-shifter copied to clipboard
Splunk Connector network-traffic:dst_ref.value translates dst_ref.value into "src" when it should be dest_ip or dest
stix-shifter translate splunk query "{}" "[url:value = 'http://www.testaddress.com/'] OR [network-traffic:dst_ref.value = '192.168.122.84']"
2022-08-08 15:51:31,571 stix_shifter_modules.splunk.stix_translation.query_translator INFO Converting STIX2 Pattern to Splunk query
{
"queries": [
"search (url = \"http://www.testaddress.com/\") OR (src = \"192.168.122.84\") earliest=\"-5minutes\" | head 10000 | fields src_ip, src_port, src_mac, src_ipv6, dest_ip, dest_port, dest_mac, dest_ipv6, file_hash, user, url, protocol, host, source, DeviceType, Direction, severity, EventID, EventName, ss_name, TacticId, Tactic, TechniqueId, Technique, process, process_id, process_name, process_exec, process_path, process_hash, parent_process, parent_process_id, parent_process_name, parent_process_exec, description, result, signature, signature_id, query, answer"
https://github.com/opencybersecurityalliance/stix-shifter/blob/2250c474cda99783dac83fca3b69d60f362d9433/stix_shifter_modules/splunk/stix_translation/json/stix_2_1/from_stix_map.json#L95
"network-traffic": {
"cim_type": "network",
"fields": {
"src_ref.value": "src",
"src_port": "src_port",
"dst_ref.value": "src",
"dst_port": "dest_port",
"protocols[*]": "protocol",
"start": "earliest",
"end": "latest"
}

Duplicate of https://github.com/opencybersecurityalliance/stix-shifter/issues/919