Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LIKE operator has wildcards added to it in some connector modules #1649

Open
pcoccoli opened this issue Feb 8, 2024 · 0 comments
Open

LIKE operator has wildcards added to it in some connector modules #1649

pcoccoli opened this issue Feb 8, 2024 · 0 comments
Labels
bug Something isn't working

Comments

@pcoccoli
Copy link
Contributor

pcoccoli commented Feb 8, 2024

Describe the bug
Some connectors (like qradar) are adding wildcards to the start and end of the user's value when translating the LIKE operator. The LIKE operator comes from SQL, according to https://docs.oasis-open.org/cti/stix/v2.0/cs01/part5-stix-patterning/stix-v2.0-cs01-part5-stix-patterning.html#_Toc496717750
stix-shifter should use the pattern supplied by the user with as little modification as necessary. If the user wants wildcards at the start and end, they can add them.

Example:

Expected behavior
Perform the search the user asked for, without changing its meaning.

@pcoccoli pcoccoli added the bug Something isn't working label Feb 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant