UncoderIO · nazargesyk · Dec 17, 2024 · Nov 11, 2024 · Dec 17, 2024 · Dec 17, 2024
diff --git a/uncoder-core/app/translator/platforms/sentinel_one/const.py b/uncoder-core/app/translator/platforms/sentinel_one/const.py
@@ -16,5 +16,19 @@
     **PLATFORM_DETAILS,
 }
 
+DEFAULT_S1EVENTS_CTI_MAPPING = {
+    "SourceIP": "SrcIP",
+    "DestinationIP": "DstIP",
+    "Domain": "DNS",
+    "URL": "Url",
+    "HashMd5": "Md5",
+    "HashSha1": "Sha1",
+    "HashSha256": "Sha256",
+    "HashSha512": "Sha512",
+    "Emails": "emails",
+    "Files": "TgtFilePath",
+}
+
+
 sentinel_one_events_query_details = PlatformDetails(**SENTINEL_ONE_EVENTS_QUERY_DETAILS)
 sentinel_one_power_query_details = PlatformDetails(**SENTINEL_ONE_POWER_QUERY_DETAILS)
diff --git a/uncoder-core/app/translator/platforms/sentinel_one/custom_types/__init__.py b/uncoder-core/app/translator/platforms/sentinel_one/custom_types/__init__.py
diff --git a/uncoder-core/app/translator/platforms/sentinel_one/custom_types/values.py b/uncoder-core/app/translator/platforms/sentinel_one/custom_types/values.py
diff --git a/uncoder-core/app/translator/platforms/sentinel_one/escape_manager.py b/uncoder-core/app/translator/platforms/sentinel_one/escape_manager.py
@@ -3,14 +3,12 @@
 from app.translator.core.custom_types.values import ValueType
 from app.translator.core.escape_manager import EscapeManager
 from app.translator.core.models.escape_details import EscapeDetails
-from app.translator.platforms.sentinel_one.custom_types.values import SentinelOneValueType
 
 
 class SentinelOnePowerQueryEscapeManager(EscapeManager):
     escape_map: ClassVar[dict[str, list[EscapeDetails]]] = {
         ValueType.value: [EscapeDetails(pattern=r"\\", escape_symbols=r"\\\\")],
         ValueType.regex_value: [EscapeDetails(pattern=r"([$^*+()\[\]{}|.?\-\\])", escape_symbols=r"\\\1")],
-        SentinelOneValueType.double_escape_regex_value: [EscapeDetails(pattern=r"\\", escape_symbols=r"\\\\")],
     }
 
 

diff --git a/uncoder-core/app/translator/platforms/sentinel_one/mappings/__init__.py b/uncoder-core/app/translator/platforms/sentinel_one/mappings/__init__.py
diff --git a/uncoder-core/app/translator/platforms/sentinel_one/mappings/s1_cti.py b/uncoder-core/app/translator/platforms/sentinel_one/mappings/s1_cti.py
diff --git a/uncoder-core/app/translator/platforms/sentinel_one/renders/s1_cti.py b/uncoder-core/app/translator/platforms/sentinel_one/renders/s1_cti.py
@@ -20,8 +20,7 @@
 from app.translator.core.models.platform_details import PlatformDetails
 from app.translator.core.render_cti import RenderCTI
 from app.translator.managers import render_cti_manager
-from app.translator.platforms.sentinel_one.const import sentinel_one_events_query_details
-from app.translator.platforms.sentinel_one.mappings.s1_cti import DEFAULT_S1EVENTS_MAPPING
+from app.translator.platforms.sentinel_one.const import DEFAULT_S1EVENTS_CTI_MAPPING, sentinel_one_events_query_details
 
 
 @render_cti_manager.register
@@ -35,4 +34,4 @@ class S1EventsCTI(RenderCTI):
     result_join: str = ""
     final_result_for_many: str = "({result})\n"
     final_result_for_one: str = "{result}\n"
-    default_mapping = DEFAULT_S1EVENTS_MAPPING
+    default_mapping = DEFAULT_S1EVENTS_CTI_MAPPING