You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
In STIX pattern, a property or partial property that has dash - in it needs to be wrapped with single quotes, such as [file:hashes.'SHA-256' = 'xxxxxxxxx...']. This mean in Kestrel, one needs to write GET file WHERE hashes.'SHA-256' = 'xxxxxx...'. This rule may not be expected by most users. Thinking to relax it so users can write GET file WHERE hashes.SHA-256 = 'xxxxxx...' and Kestrel will assemble the STIX pattern with single quotes if needed.
Note that Kestrel is STIX compatible, so if we implement this, it will still allow users to have single quotes like hashes.'SHA-256', in which case Kestrel will not modify the string when assembling the STIX pattern.
Describe the solution you'd like firepit also needs the single quotes. So we can possibly add the single quotes if not there around substrings in attributes with dashes in the parser (transformer).
Describe alternatives you've considered
Do the modification in to_stix() and to_firepit() in ECGP.
Additional context
Additional consideration is whether this (difference from STIX) makes extra confusion for users who are familiar with STIX. However, since the planned solution supports both (just relaxing the strict single quote requirement), this could be fine.
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem? Please describe.
In STIX pattern, a property or partial property that has dash
-
in it needs to be wrapped with single quotes, such as[file:hashes.'SHA-256' = 'xxxxxxxxx...']
. This mean in Kestrel, one needs to writeGET file WHERE hashes.'SHA-256' = 'xxxxxx...'
. This rule may not be expected by most users. Thinking to relax it so users can writeGET file WHERE hashes.SHA-256 = 'xxxxxx...'
and Kestrel will assemble the STIX pattern with single quotes if needed.Note that Kestrel is STIX compatible, so if we implement this, it will still allow users to have single quotes like
hashes.'SHA-256'
, in which case Kestrel will not modify the string when assembling the STIX pattern.Describe the solution you'd like
firepit
also needs the single quotes. So we can possibly add the single quotes if not there around substrings in attributes with dashes in the parser (transformer).Describe alternatives you've considered
Do the modification in
to_stix()
andto_firepit()
in ECGP.Additional context
Additional consideration is whether this (difference from STIX) makes extra confusion for users who are familiar with STIX. However, since the planned solution supports both (just relaxing the strict single quote requirement), this could be fine.
The text was updated successfully, but these errors were encountered: