Skip to content

Kestrel requires process:x_unique_id but some data sources don't map it #487

@pcoccoli

Description

@pcoccoli

Describe the bug
Kestrel is trying to use x_unique_id (in prefetch) which causes stix-shifter to throw an error

Details of the bug

  • What is the hunt flow/script you are executing?
pp = GET process FROM stixshifter://reaqta
     WHERE [ipv4-addr:value = '192.168.1.1']
     START t'2024-03-08T10:45:00Z' STOP t'2024-03-08T11:00:00Z'
     
DISP pp ATTR name
  • What is the command that failed?
    The GET command fails.
  • What is the error message?
[ERROR] DataSourceError: STIX-shifter translation from STIX to native query failed with message: reaqta connector error => data mapping error : Unable to map the following STIX objects and properties: ['process:x_unique_id'] to data source fields
please check data source config or diagnose with stix-shifter-diag command.
  • If it is a STIX-Shifter related issue, what is the results of STIX-Shifter translation?
  • If it is a STIX-Shifter related issue, what is the results of STIX-Shifter transmission?

To Reproduce
Steps to reproduce the behavior:

  1. setup a data source: e.g. reaqta
  2. run hunt flow above

Expected behavior
Kestrel needs some fallback mechanism when an optional extension property like x_unique_id isn't mapped, even if it just ignores the failed prefetch.

Additional context
opencybersecurityalliance/stix-shifter#1650

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions