Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

QRadarEpochToTimestamp for exponential notation #1352

Merged
merged 3 commits into from
Mar 2, 2023
Merged

QRadarEpochToTimestamp for exponential notation #1352

merged 3 commits into from
Mar 2, 2023

Conversation

KaneBrennan132
Copy link
Contributor

When using "group by" during an AQL passthrough, it was found that Qradar can return epoch values using exponential notation (e.g 1.674125456158E12) and this would fail being transformed into a timestamp, causing the DE search to fail.

Added a custom epoch to timestamp transformer that handles epoch values using exponential notation.

@delliott90
Copy link
Collaborator

Can we get a unit test around this?

@codecov
Copy link

codecov bot commented Mar 1, 2023

Codecov Report

Patch coverage: 95.55% and project coverage change: +0.01 🎉

Comparison is base (8a82d3f) 85.42% compared to head (9a5d33a) 85.43%.

Additional details and impacted files
@@             Coverage Diff             @@
##           develop    #1352      +/-   ##
===========================================
+ Coverage    85.42%   85.43%   +0.01%     
===========================================
  Files          569      569              
  Lines        42693    42734      +41     
===========================================
+ Hits         36471    36511      +40     
- Misses        6222     6223       +1     
Impacted Files Coverage Δ
...er_modules/qradar/stix_translation/transformers.py 81.25% <75.00%> (-2.09%) ⬇️
.../stix_translation/test_elastic_ecs_json_to_stix.py 100.00% <100.00%> (ø)
...tests/stix_translation/test_qradar_json_to_stix.py 100.00% <100.00%> (ø)
...r_utils/stix_translation/src/utils/transformers.py 83.25% <0.00%> (+0.47%) ⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

@KaneBrennan132
Copy link
Contributor Author

Added test for start and end time epoch values using exponential notation.

@delliott90 delliott90 merged commit 7ceb131 into opencybersecurityalliance:develop Mar 2, 2023
@KaneBrennan132 KaneBrennan132 deleted the QRadar-Custom-EpochToTimestamp-Transformer branch March 2, 2023 15:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants