Skip to content

Commit b7893c4

Browse files
tarnopolskyitarnopolskyi
committed
merge prod
1 parent 8f99a55 commit b7893c4

File tree

28 files changed

+124
-80
lines changed

28 files changed

+124
-80
lines changed

‎uncoder-core/app/translator/core/context_vars.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
from contextvars import ContextVar
22

33
return_only_first_query_ctx_var: ContextVar[bool] = ContextVar("return_only_first_query_ctx_var", default=False)
4-
"""Set to True to return ony first query if rendered multiple options"""
4+
"""Set to True to return only first query if rendered multiple options"""

‎uncoder-core/app/translator/core/render.py

Lines changed: 31 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,10 @@
1616
limitations under the License.
1717
-----------------------------------------------------------------
1818
"""
19+
1920
from abc import ABC, abstractmethod
2021
from collections.abc import Callable
21-
from typing import Optional, Union
22+
from typing import ClassVar, Optional, Union
2223

2324
from app.translator.const import DEFAULT_VALUE_TYPE
2425
from app.translator.core.context_vars import return_only_first_query_ctx_var
@@ -165,7 +166,14 @@ class QueryRender(ABC):
165166
is_single_line_comment: bool = False
166167
unsupported_functions_text = "Unsupported functions were excluded from the result query:"
167168

168-
platform_functions: PlatformFunctions = PlatformFunctions()
169+
platform_functions: PlatformFunctions = None
170+
171+
def __init__(self):
172+
self.init_platform_functions()
173+
174+
def init_platform_functions(self) -> None:
175+
self.platform_functions = PlatformFunctions()
176+
self.platform_functions.platform_query_render = self
169177

170178
def render_not_supported_functions(self, not_supported_functions: list) -> str:
171179
line_template = f"{self.comment_symbol} " if self.comment_symbol and self.is_single_line_comment else ""
@@ -192,19 +200,19 @@ class PlatformQueryRender(QueryRender):
192200

193201
field_value_map = BaseQueryFieldValue(or_token=or_token)
194202

195-
query_pattern = "{table} {query} {functions}"
196-
raw_log_field_pattern_map: dict = None
203+
raw_log_field_pattern_map: ClassVar[dict[str, str]] = None
197204

198205
def __init__(self):
206+
super().__init__()
199207
self.operator_map = {
200208
LogicalOperatorType.AND: f" {self.and_token} ",
201209
LogicalOperatorType.OR: f" {self.or_token} ",
202210
LogicalOperatorType.NOT: f" {self.not_token} ",
203211
}
204212

205-
def generate_prefix(self, log_source_signature: LogSourceSignature, functions_prefix: str = "") -> str: # noqa: ARG002
206-
if str(log_source_signature):
207-
return f"{log_source_signature!s} {self.and_token}"
213+
def generate_prefix(self, log_source_signature: Optional[LogSourceSignature], functions_prefix: str = "") -> str: # noqa: ARG002
214+
if log_source_signature and str(log_source_signature):
215+
return f"{log_source_signature} {self.and_token}"
208216
return ""
209217

210218
def generate_functions(self, functions: list[Function], source_mapping: SourceMapping) -> RenderedFunctions:
@@ -272,6 +280,10 @@ def wrap_query_with_meta_info(self, meta_info: MetaInfoContainer, query: str) ->
272280
query = f"{query}\n\n{query_meta_info}"
273281
return query
274282

283+
@staticmethod
284+
def _finalize_search_query(query: str) -> str:
285+
return query
286+
275287
def finalize_query(
276288
self,
277289
prefix: str,
@@ -283,8 +295,8 @@ def finalize_query(
283295
*args, # noqa: ARG002
284296
**kwargs, # noqa: ARG002
285297
) -> str:
286-
query = self.query_pattern.format(prefix=prefix, query=query, functions=functions).strip()
287-
298+
parts = filter(lambda s: bool(s), map(str.strip, [prefix, self._finalize_search_query(query), functions]))
299+
query = " ".join(parts)
288300
query = self.wrap_query_with_meta_info(meta_info=meta_info, query=query)
289301
if not_supported_functions:
290302
rendered_not_supported = self.render_not_supported_functions(not_supported_functions)
@@ -327,15 +339,15 @@ def _generate_from_raw_query_container(self, query_container: RawQueryContainer)
327339

328340
def process_raw_log_field(self, field: str, field_type: str) -> Optional[str]:
329341
if raw_log_field_pattern := self.raw_log_field_pattern_map.get(field_type):
330-
return raw_log_field_pattern.pattern.format(field=field)
342+
return raw_log_field_pattern.format(field=field)
331343

332344
def process_raw_log_field_prefix(self, field: str, source_mapping: SourceMapping) -> Optional[list]:
333345
if isinstance(field, list):
334-
list_of_prefix = []
346+
prefix_list = []
335347
for f in field:
336-
if prepared_prefix := self.process_raw_log_field_prefix(field=f, source_mapping=source_mapping):
337-
list_of_prefix.extend(prepared_prefix)
338-
return list_of_prefix
348+
if _prefix_list := self.process_raw_log_field_prefix(field=f, source_mapping=source_mapping):
349+
prefix_list.extend(_prefix_list)
350+
return prefix_list
339351
if raw_log_field_type := source_mapping.raw_log_fields.get(field):
340352
return [self.process_raw_log_field(field=field, field_type=raw_log_field_type)]
341353

@@ -352,9 +364,11 @@ def generate_raw_log_fields(self, fields: list[Field], source_mapping: SourceMap
352364
)
353365
if not mapped_field and self.is_strict_mapping:
354366
raise StrictPlatformException(field_name=field.source_name, platform_name=self.details.name)
355-
if field_prefix := self.process_raw_log_field_prefix(field=mapped_field, source_mapping=source_mapping):
356-
defined_raw_log_fields.extend(field_prefix)
357-
return "\n".join(set(defined_raw_log_fields))
367+
if prefix_list := self.process_raw_log_field_prefix(field=mapped_field, source_mapping=source_mapping):
368+
for prefix in prefix_list:
369+
if prefix not in defined_raw_log_fields:
370+
defined_raw_log_fields.append(prefix)
371+
return "\n".join(defined_raw_log_fields)
358372

359373
def _generate_from_tokenized_query_container(self, query_container: TokenizedQueryContainer) -> str:
360374
queries_map = {}

‎uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/default.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ field_mapping:
7777
OldTargetUserName: xdm.target.user.username
7878
UserPrincipalName: xdm.source.user.username
7979
DestAddress: xdm.target.ipv4
80+
SubjectAccountName: xdm.source.user.username
8081
SubjectUserName: xdm.source.user.username
8182
SubjectUserSid: xdm.source.user.identifier
8283
SourceAddr: xdm.source.ipv4
@@ -117,7 +118,6 @@ field_mapping:
117118
method: xdm.network.http.method
118119
notice.user_agent: xdm.network.http.browser
119120
hasIdentity: xdm.source.user.identity_type
120-
SubjectAccountName: xdm.source.user.username
121121
ComputerName: xdm.source.host.hostname
122122
ExternalSeverity: xdm.alert.severity
123123
SourceMAC: xdm.source.host.mac_addresses

‎uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/windows_security.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@ default_log_source:
77
field_mapping:
88
EventID: action_evtlog_event_id
99
Provider_Name: provider_name
10-
10+
SubjectAccountName: actor_effective_username
11+
1112
raw_log_fields:
1213
ParentImage: regex
1314
AccessMask: regex

‎uncoder-core/app/translator/mappings/platforms/qradar/windows_security.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,9 @@ field_mapping:
130130
NewValue: NewValue
131131
Source: Source
132132
Status: Status
133+
SubjectAccountName:
134+
- Subject Account Name
135+
- SubjectAccountName
133136
SubjectDomainName: SubjectDomainName
134137
SubjectUserName: Target Username
135138
SubjectUserSid: SubjectUserSid
@@ -171,5 +174,4 @@ field_mapping:
171174
UserID: UserID
172175
ParentProcessName: Parent Process Name
173176
Service: Service
174-
hasIdentity: hasIdentity
175-
SubjectAccountName: SubjectAccountName
177+
hasIdentity: hasIdentity

‎uncoder-core/app/translator/platforms/athena/renders/athena.py

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
limitations under the License.
1717
-----------------------------------------------------------------
1818
"""
19+
1920
from app.translator.core.models.platform_details import PlatformDetails
2021
from app.translator.managers import render_manager
2122
from app.translator.platforms.athena.const import athena_details
@@ -35,6 +36,9 @@ class AthenaQueryRender(SqlQueryRender):
3536
or_token = "OR"
3637

3738
field_value_map = AthenaFieldValue(or_token=or_token)
38-
query_pattern = "{prefix} WHERE {query} {functions}"
3939
comment_symbol = "--"
4040
is_single_line_comment = True
41+
42+
@staticmethod
43+
def _finalize_search_query(query: str) -> str:
44+
return f"WHERE {query}" if query else ""

‎uncoder-core/app/translator/platforms/base/aql/renders/aql.py

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
limitations under the License.
1717
-----------------------------------------------------------------
1818
"""
19+
1920
from typing import Union
2021

2122
from app.translator.const import DEFAULT_VALUE_TYPE
@@ -127,7 +128,6 @@ class AQLQueryRender(PlatformQueryRender):
127128
not_token = "NOT"
128129

129130
field_value_map = AQLFieldValue(or_token=or_token)
130-
query_pattern = "{prefix} AND {query} {functions}"
131131

132132
def generate_prefix(self, log_source_signature: AQLLogSourceSignature, functions_prefix: str = "") -> str: # noqa: ARG002
133133
table = str(log_source_signature)
@@ -136,3 +136,7 @@ def generate_prefix(self, log_source_signature: AQLLogSourceSignature, functions
136136

137137
def wrap_with_comment(self, value: str) -> str:
138138
return f"/* {value} */"
139+
140+
@staticmethod
141+
def _finalize_search_query(query: str) -> str:
142+
return f"AND {query}" if query else ""

‎uncoder-core/app/translator/platforms/base/lucene/renders/lucene.py

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
limitations under the License.
1717
-----------------------------------------------------------------
1818
"""
19+
1920
from typing import Optional, Union
2021

2122
from app.translator.const import DEFAULT_VALUE_TYPE
@@ -106,8 +107,6 @@ class LuceneQueryRender(PlatformQueryRender):
106107
and_token = "AND"
107108
not_token = "NOT"
108109

109-
query_pattern = "{query} {functions}"
110-
111110
comment_symbol = "//"
112111
is_single_line_comment = True
113112

‎uncoder-core/app/translator/platforms/base/spl/renders/spl.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
limitations under the License.
1717
-----------------------------------------------------------------
1818
"""
19+
1920
from typing import Union
2021

2122
from app.translator.const import DEFAULT_VALUE_TYPE
@@ -78,7 +79,6 @@ class SplQueryRender(PlatformQueryRender):
7879
and_token = "AND"
7980
not_token = "NOT"
8081

81-
query_pattern = "{prefix} {query} {functions}"
8282
comment_symbol = "```"
8383

8484
def wrap_with_comment(self, value: str) -> str:

‎uncoder-core/app/translator/platforms/base/sql/renders/sql.py

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
limitations under the License.
1717
-----------------------------------------------------------------
1818
"""
19+
1920
from typing import Union
2021

2122
from app.translator.const import DEFAULT_VALUE_TYPE
@@ -76,10 +77,13 @@ class SqlQueryRender(PlatformQueryRender):
7677
and_token = "AND"
7778
not_token = "NOT"
7879

79-
query_pattern = "{prefix} WHERE {query} {functions}"
8080
comment_symbol = "--"
8181
is_single_line_comment = True
8282

8383
def generate_prefix(self, log_source_signature: LogSourceSignature, functions_prefix: str = "") -> str: # noqa: ARG002
8484
table = str(log_source_signature) if str(log_source_signature) else "eventlog"
8585
return f"SELECT * FROM {table}"
86+
87+
@staticmethod
88+
def _finalize_search_query(query: str) -> str:
89+
return f"WHERE {query}" if query else ""

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy