diff --git a/translator/app/translator/platforms/logscale/escape_manager.py b/translator/app/translator/platforms/logscale/escape_manager.py index cd5132e0..2a5c8aac 100644 --- a/translator/app/translator/platforms/logscale/escape_manager.py +++ b/translator/app/translator/platforms/logscale/escape_manager.py @@ -5,7 +5,7 @@ class LogscaleEscapeManager(EscapeManager): escape_map = { - ValueType.value: EscapeDetails(pattern='(\+|\\\\|{|\[|\*|"|\(|\)|/(?![*?\\\\]))') + ValueType.value: EscapeDetails(pattern='(/|\+|\\\\|{|\[|\*|"|\(|\)(?![*?\\\\]))') } diff --git a/translator/app/translator/platforms/logscale/renders/logscale.py b/translator/app/translator/platforms/logscale/renders/logscale.py index f851e94a..aff37dcb 100644 --- a/translator/app/translator/platforms/logscale/renders/logscale.py +++ b/translator/app/translator/platforms/logscale/renders/logscale.py @@ -63,7 +63,7 @@ def not_equal_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: def contains_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: if isinstance(value, list): return f"({self.or_token.join(self.contains_modifier(field=field, value=v) for v in value)})" - return f'{self.apply_field_name(field_name=field)}=/{self.apply_value(value)}/i' + return f'{self.apply_field_name(field_name=field)}=/{self.apply_value(value) if value else "^"}/i' def endswith_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str: if isinstance(value, list): diff --git a/translator/app/translator/platforms/qradar/escape_manager.py b/translator/app/translator/platforms/qradar/escape_manager.py index 18462b01..1b33fd7f 100644 --- a/translator/app/translator/platforms/qradar/escape_manager.py +++ b/translator/app/translator/platforms/qradar/escape_manager.py @@ -1,12 +1,8 @@ -from app.translator.core.custom_types.values import ValueType from app.translator.core.escape_manager import EscapeManager -from app.translator.core.models.escape_details import EscapeDetails class QradarEscapeManager(EscapeManager): - escape_map = { - ValueType.value: EscapeDetails(pattern="([\\\])") - } + escape_map = {} qradar_escape_manager = QradarEscapeManager() diff --git a/translator/app/translator/platforms/qradar/renders/qradar.py b/translator/app/translator/platforms/qradar/renders/qradar.py index 15f61a21..5e235aa7 100644 --- a/translator/app/translator/platforms/qradar/renders/qradar.py +++ b/translator/app/translator/platforms/qradar/renders/qradar.py @@ -35,10 +35,10 @@ class QradarFieldValue(BaseQueryFieldValue): def apply_value(self, value: Union[str, int], value_type: str = ValueType.value) -> Union[str, int]: if isinstance(value, str): - value = value.replace("\\'", "%").replace("'", '"') + value = value.replace("_", "__").replace("%", "%%").replace("\\'", "%").replace("'", '"') if value.endswith("\\\\%"): value = value.replace("\\\\%", "\\%") - return super().apply_value(value, value_type) + return value def _apply_value(self, value: Union[str, int]) -> Union[str, int]: if isinstance(value, str) and "\\" in value: