stix-shifter icon indicating copy to clipboard operation
stix-shifter copied to clipboard

Wrong start/stop qualifier format doesn't show proper error message in splunk

Open mdazam1942 opened this issue 3 years ago • 0 comments

Describe the bug If wrong timestamp format is specified in the start/stop qualifier for splunk translate command then it doesn't show proper error message.

To Reproduce

This splunk translate command: stix-shifter translate splunk query {} "[ipv4-addr:value = '10.1.1.1'] START t'2022-03-03T00:00:00Z' STOP t'2022-03-03T01:00:00Z'" yields the following error:

2022-03-17 08:44:27,593 stix_shifter.stix_translation.stix_translation ERROR Caught exception: Qualifier type not implemented <class 'NotImplementedError'>
2022-03-17 08:44:27,598 stix_shifter_utils.stix_translation.stix_translation_error_mapper ERROR received exception => NotImplementedError: Qualifier type not implemented
{
"success": false,
"code": "not_implemented",
"error": "wrong parameter : Qualifier type not implemented"
}

The error doesn't show whether the timestamp format is wrong. Expected behavior

The error should indicate that the timestamp format is wrong.

Additional context In general the\is timestamp should work but this is very specific to splunk. We need to verify why it is required to add .SSS in the. qualifier timestamp for splunk.

mdazam1942 avatar Mar 17 '22 17:03 mdazam1942