infosecn1nja
/
DeTTECT
mirror of https://github.com/infosecn1nja/DeTTECT.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'development' of https://github.com/marcusbakker/DeTTECT-private into development

master
Ruben Bouman 2020-02-19 14:52:49 +01:00
parent 531d9c6486 dae670a364
commit f834638214
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
eql_yaml.py
View File

@ -152,8 +152,10 @@ def _events_to_yaml(query_results, obj_type):
try: try:
for r in query_results: for r in query_results:
if r['date_registered'] and isinstance(r['date_registered'], str): if r['date_registered'] and isinstance(r['date_registered'], str):
r['date_registered'] = REGEX_YAML_VALID_DATE.match(r['date_registered']).group(1)
r['date_registered'] = datetime.datetime.strptime(r['date_registered'], '%Y-%m-%d') r['date_registered'] = datetime.datetime.strptime(r['date_registered'], '%Y-%m-%d')
if r['date_connected'] and isinstance(r['date_connected'], str): if r['date_connected'] and isinstance(r['date_connected'], str):
r['date_connected'] = REGEX_YAML_VALID_DATE.match(r['date_connected']).group(1)
r['date_connected'] = datetime.datetime.strptime(r['date_connected'], '%Y-%m-%d') r['date_connected'] = datetime.datetime.strptime(r['date_connected'], '%Y-%m-%d')
except KeyError: except KeyError:
print(EQL_INVALID_RESULT_DS) print(EQL_INVALID_RESULT_DS)
@ -199,7 +201,8 @@ def _events_to_yaml(query_results, obj_type):
for k, v in score_logbook_event.items(): for k, v in score_logbook_event.items():
value = v value = v
if isinstance(v, str) and REGEX_YAML_VALID_DATE.match(value): if isinstance(v, str) and REGEX_YAML_VALID_DATE.match(value):
value = datetime.datetime.strptime(v, '%Y-%m-%d') value = REGEX_YAML_VALID_DATE.match(v).group(1)
value = datetime.datetime.strptime(value, '%Y-%m-%d')
score_obj_yaml[k] = value score_obj_yaml[k] = value
# The detection/visibility dict is missing. Create it. # The detection/visibility dict is missing. Create it.

1
health.py
View File

@ -137,7 +137,6 @@ def check_health_data_sources(filename, ds_content, health_is_called, no_print=F
except AttributeError: except AttributeError:
has_error = _print_error_msg('[!] Data source: \'' + ds['data_source_name'] + '\' has an INVALID data format for the key-value pair \'' + key has_error = _print_error_msg('[!] Data source: \'' + ds['data_source_name'] + '\' has an INVALID data format for the key-value pair \'' + key
+ '\': ' + ds[key] + ' (should be YYYY-MM-DD without quotes)', health_is_called) + '\': ' + ds[key] + ' (should be YYYY-MM-DD without quotes)', health_is_called)
print(type(ds[key]))
if 'available_for_data_analytics' in ds: if 'available_for_data_analytics' in ds:
if not isinstance(ds['available_for_data_analytics'], bool): if not isinstance(ds['available_for_data_analytics'], bool):