fix stix 2.1

opencybersecurityalliance · Mar 24, 2022 · 5ef7d1d · 5ef7d1d
1 parent 7f947cc
commit 5ef7d1d
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 29 deletions.
diff --git a/stix_shifter_modules/arcsight/stix_translation/json/stix_2_1/from_stix_map.json b/stix_shifter_modules/arcsight/stix_translation/json/stix_2_1/from_stix_map.json
@@ -39,7 +39,6 @@
   },
    "process" : {
     "fields": {
-      "name": ["destinationProcessName", "sourceProcessName"],
       "parent_ref.name": ["sourceProcessName"],
       "command_line": ["destinationServiceName", "sourceServiceName"]
     }
@@ -112,7 +111,8 @@
       "destination_fqdn": ["fulltextSearch"],
       "destination_nt_domain": ["destinationNtDomain"],
       "destination_geo_location_info": ["fulltextSearch"],
-      "destination_geo_postal_code": ["fulltextSearch"]
+      "destination_geo_postal_code": ["fulltextSearch"],
+      "destination_process_name": ["destinationProcessName"]
     }
   },
   "x-arcsight-event-source": {
@@ -123,7 +123,8 @@
       "source_fqdn": ["fulltextSearch"],
       "source_nt_domain": ["sourceNtDomain"],
       "source_geo_location_info": ["fulltextSearch"],
-      "source_geo_postal_code": ["fulltextSearch"]
+      "source_geo_postal_code": ["fulltextSearch"],
+      "source_process_name": ["sourceProcessName"]
     }
   },
   "x-arcsight-event-vulnerability": {

diff --git a/stix_shifter_modules/arcsight/stix_translation/json/stix_2_1/to_stix_map.json b/stix_shifter_modules/arcsight/stix_translation/json/stix_2_1/to_stix_map.json
@@ -135,20 +135,13 @@
       }
     ],
     "destinationProcessName": {
-      "key": "process.name",
-      "object": "process"
+      "key": "x-arcsight-event-destination.destination_process_name",
+      "object": "destination"
+    },
+    "sourceProcessName":  {
+      "key": "x-arcsight-event-source.source_process_name",
+      "object": "source"
     },
-    "sourceProcessName": [
-      {
-        "key": "process.name",
-        "object": "parent_process"
-      },
-      {
-        "key": "process.parent_ref",
-        "object": "process",
-        "references": "parent_process"
-      }
-    ],
     "destinationServiceName": {
       "key": "process.command_line",
       "object": "process"
@@ -676,20 +669,13 @@
       }
     ],
     "destinationProcessName": {
-      "key": "process.name",
-      "object": "process"
+      "key": "x-arcsight-event-destination.destination_process_name",
+      "object": "destination"
+    },
+    "sourceProcessName":  {
+      "key": "x-arcsight-event-source.source_process_name",
+      "object": "source"
     },
-    "sourceProcessName": [
-      {
-        "key": "process.name",
-        "object": "parent_process"
-      },
-      {
-        "key": "process.parent_ref",
-        "object": "process",
-        "references": "parent_process"
-      }
-    ],
     "destinationServiceName": {
       "key": "process.command_line",
       "object": "process"