Merge pull request #75 from UncoderIO/gis-fix-gen-all-bug

tarnopolskyi · web-flow · commit f56ab2224486 · 2024-03-12T11:56:54.000+01:00
Gis fix gen all bug
diff --git a/translator/app/translator/platforms/logrhythm_axon/renders/logrhythm_axon_rule.py b/translator/app/translator/platforms/logrhythm_axon/renders/logrhythm_axon_rule.py
@@ -16,7 +16,6 @@
 limitations under the License.
 -----------------------------------------------------------------
 """
-
 import copy
 import json
 from typing import Optional
@@ -50,21 +49,6 @@ class LogRhythmAxonRuleRender(LogRhythmAxonQueryRender):
     or_token = "or"
     field_value_map = LogRhythmAxonRuleFieldValue(or_token=or_token)
 
-    def __create_mitre_threat(self, meta_info: MetaInfoContainer) -> tuple[list, list]:
-        tactics = set()
-        techniques = []
-
-        for tactic in meta_info.mitre_attack.get("tactics"):
-            tactics.add(tactic["tactic"])
-
-        for technique in meta_info.mitre_attack.get("techniques"):
-            if technique.get("tactic"):
-                for tactic in technique["tactic"]:
-                    tactics.add(tactic)
-            techniques.append(technique["technique_id"])
-
-        return sorted(tactics), sorted(techniques)
-
     def finalize_query(
         self,
         prefix: str,
@@ -91,11 +75,11 @@ def finalize_query(
         )
         if tactics := meta_info.mitre_attack.get("tactics"):
             rule["observationPipeline"]["metadataFields"]["threat.mitre_tactic"] = ", ".join(
-                f"{i['external_id']}:{i['tactic']}" for i in tactics
+                f"{i['external_id']}:{i['tactic']}" for i in sorted(tactics, key=lambda x: x["external_id"])
             )
         if techniques := meta_info.mitre_attack.get("techniques"):
             rule["observationPipeline"]["metadataFields"]["threat.mitre_technique"] = ", ".join(
-                f"{i['technique_id']}:{i['technique']}" for i in techniques
+                f"{i['technique_id']}:{i['technique']}" for i in sorted(techniques, key=lambda x: x["technique_id"])
             )
         if meta_info.fields:
             rule["observationPipeline"]["pattern"]["operations"][0]["logObserved"]["groupByFields"] = [
diff --git a/translator/app/translator/translator.py b/translator/app/translator/translator.py
@@ -87,7 +87,7 @@ def __generate_all(self, text: str, source: str) -> list[dict]:
                 status, data = self.__render_translation(query_container=raw_query_container, target=target)
             else:
                 status, data = self.__render_translation(query_container=tokenized_query_container, target=target)
-            result.append({"status": status, "result": parsed_data, "siem_type": target})
+            result.append({"status": status, "result": data, "siem_type": target})
 
         return result
 
