Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

relax single quote requirement for attribute with dash #266

Open
subbyte opened this issue Nov 17, 2022 · 0 comments
Open

relax single quote requirement for attribute with dash #266

subbyte opened this issue Nov 17, 2022 · 0 comments
Labels
enhancement New feature or request

Comments

@subbyte
Copy link
Member

subbyte commented Nov 17, 2022

Is your feature request related to a problem? Please describe.
In STIX pattern, a property or partial property that has dash - in it needs to be wrapped with single quotes, such as [file:hashes.'SHA-256' = 'xxxxxxxxx...']. This mean in Kestrel, one needs to write GET file WHERE hashes.'SHA-256' = 'xxxxxx...'. This rule may not be expected by most users. Thinking to relax it so users can write GET file WHERE hashes.SHA-256 = 'xxxxxx...' and Kestrel will assemble the STIX pattern with single quotes if needed.

Note that Kestrel is STIX compatible, so if we implement this, it will still allow users to have single quotes like hashes.'SHA-256', in which case Kestrel will not modify the string when assembling the STIX pattern.

Describe the solution you'd like
firepit also needs the single quotes. So we can possibly add the single quotes if not there around substrings in attributes with dashes in the parser (transformer).

Describe alternatives you've considered
Do the modification in to_stix() and to_firepit() in ECGP.

Additional context
Additional consideration is whether this (difference from STIX) makes extra confusion for users who are familiar with STIX. However, since the planned solution supports both (just relaxing the strict single quote requirement), this could be fine.

@subbyte subbyte added the enhancement New feature or request label Nov 17, 2022
@subbyte subbyte added this to the Parser upgrade milestone Nov 17, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant