Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Normalization functions not removed by convert-query #29

Closed
rw-access opened this issue Mar 31, 2020 · 0 comments · Fixed by #30
Closed

Normalization functions not removed by convert-query #29

rw-access opened this issue Mar 31, 2020 · 0 comments · Fixed by #30
Assignees

Comments

@rw-access
Copy link
Contributor

rw-access commented Mar 31, 2020

Describe the bug

When running convert-query on a field that uses a normalization function (ex. baseName(path)), the normalization function is not stripped from the converted query in a handful of queries. This can lead to issues down the road if the function is not found as expected.

To Reproduce

Steps to reproduce the behavior:

$ eqllib convert-query -s "Endgame Platform" "registry where registry_value == '*foo*'"
registry where baseName(key_path) == "*foo*"

This fails in particular because there is no translation rule for normalizing wildcard comparisons. If you were checking for foo with no wildcards, you'd get something like this, which is one case where normalization works as expected.

$ eqllib convert-query -s "Endgame Platform" "registry where registry_value == 'foo'"
registry where key_path == "*\\foo"

Expected behavior

Instead of linking to undefined functions, an exception should be raised, or the underlying field should be returned as is.

$ eqllib convert-query -s "Endgame Platform" "registry where registry_value == '*blah'"
registry where key_path == "*\\*blah"
@rw-access rw-access self-assigned this Mar 31, 2020
@rw-access rw-access transferred this issue from endgameinc/eql Mar 31, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant