Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wrong start/stop qualifier format doesn't show proper error message in splunk #855

Closed
mdazam1942 opened this issue Mar 17, 2022 · 1 comment · Fixed by #1084
Closed

Wrong start/stop qualifier format doesn't show proper error message in splunk #855

mdazam1942 opened this issue Mar 17, 2022 · 1 comment · Fixed by #1084
Assignees
Labels
bug Something isn't working

Comments

@mdazam1942
Copy link
Member

Describe the bug
If wrong timestamp format is specified in the start/stop qualifier for splunk translate command then it doesn't show proper error message.

To Reproduce

This splunk translate command:
stix-shifter translate splunk query {} "[ipv4-addr:value = '10.1.1.1'] START t'2022-03-03T00:00:00Z' STOP t'2022-03-03T01:00:00Z'"
yields the following error:

2022-03-17 08:44:27,593 stix_shifter.stix_translation.stix_translation ERROR Caught exception: Qualifier type not implemented <class 'NotImplementedError'>
2022-03-17 08:44:27,598 stix_shifter_utils.stix_translation.stix_translation_error_mapper ERROR received exception => NotImplementedError: Qualifier type not implemented
{
"success": false,
"code": "not_implemented",
"error": "wrong parameter : Qualifier type not implemented"
}

The error doesn't show whether the timestamp format is wrong.
Expected behavior

The error should indicate that the timestamp format is wrong.

Additional context
In general the\is timestamp should work but this is very specific to splunk. We need to verify why it is required to add .SSS in the. qualifier timestamp for splunk.

@mdazam1942 mdazam1942 added the bug Something isn't working label Mar 17, 2022
@mdazam1942 mdazam1942 self-assigned this Mar 18, 2022
@pcoccoli
Copy link
Contributor

I think the real bug is that the connector requires milliseconds. It should accept any number of digits after the decimal, or no decimal at all: https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_ksbm2nost85y

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants