-
Notifications
You must be signed in to change notification settings - Fork 52
Open
Labels
bugSomething isn't workingSomething isn't working
Description
Describe the bug
Kestrel is trying to use x_unique_id (in prefetch) which causes stix-shifter to throw an error
Details of the bug
- What is the hunt flow/script you are executing?
pp = GET process FROM stixshifter://reaqta
WHERE [ipv4-addr:value = '192.168.1.1']
START t'2024-03-08T10:45:00Z' STOP t'2024-03-08T11:00:00Z'
DISP pp ATTR name
- What is the command that failed?
TheGETcommand fails. - What is the error message?
[ERROR] DataSourceError: STIX-shifter translation from STIX to native query failed with message: reaqta connector error => data mapping error : Unable to map the following STIX objects and properties: ['process:x_unique_id'] to data source fields
please check data source config or diagnose with stix-shifter-diag command.
- If it is a STIX-Shifter related issue, what is the results of STIX-Shifter translation?
- If it is a STIX-Shifter related issue, what is the results of STIX-Shifter transmission?
To Reproduce
Steps to reproduce the behavior:
- setup a data source: e.g. reaqta
- run hunt flow above
Expected behavior
Kestrel needs some fallback mechanism when an optional extension property like x_unique_id isn't mapped, even if it just ignores the failed prefetch.
Additional context
opencybersecurityalliance/stix-shifter#1650
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working