Splunk: Fix MAC address to display in proper STIX format

stix_shifter_modules/splunk/stix_translation/json/stix_2_1/to_stix_map.json

@@ -397,7 +397,8 @@
   "src_mac": [
     {
       "key": "mac-addr.value",
-      "object": "src_mac"
+      "object": "src_mac",
+      "transformer": "SplunkMacFormatChange"
     },
     {
       "key": "ipv4-addr.resolves_to_refs",
@@ -417,7 +418,8 @@
   "dest_mac": [
     {
       "key": "mac-addr.value",
-      "object": "dst_mac"
+      "object": "dst_mac",
+      "transformer": "SplunkMacFormatChange"
     },
     {
       "key": "ipv4-addr.resolves_to_refs",

stix_shifter_modules/splunk/stix_translation/json/to_stix_map.json

@@ -397,7 +397,8 @@
   "src_mac": [
     {
       "key": "mac-addr.value",
-      "object": "src_mac"
+      "object": "src_mac",
+      "transformer": "SplunkMacFormatChange"
     },
     {
       "key": "ipv4-addr.resolves_to_refs",
@@ -417,7 +418,8 @@
   "dest_mac": [
     {
       "key": "mac-addr.value",
-      "object": "dst_mac"
+      "object": "dst_mac",
+      "transformer": "SplunkMacFormatChange"
     },
     {
       "key": "ipv4-addr.resolves_to_refs",

stix_shifter_modules/splunk/stix_translation/transformers.py

@@ -1,5 +1,5 @@
 from stix_shifter_utils.stix_translation.src.utils.transformers import ValueTransformer
-
+import re
 
 class SplunkToTimestamp(ValueTransformer):
     """A value transformer for converting Splunk timestamp to regular timestamp"""
@@ -46,3 +46,20 @@ def get_pair_of_hash(hash_raw):
                 return obj
             hashes = dict(map(lambda x: get_pair_of_hash(x), hashes))
             return hashes
+
+
+class SplunkMacFormatChange(ValueTransformer):
+    """    A value transformer for converting MAC value into stix format(using : separator)  """
+
+    @staticmethod
+    def transform(macvalue):
+        """correcting mac address presentation, it should be 6 octate separated
+         by only colon (:) not by any other special character """
+        macvalue = re.sub("[^A-Fa-f0-9]", "", macvalue)
+        maclength = len(macvalue)
+        if (maclength<12):
+            for i in range(maclength, 12):
+                macvalue = "0" + macvalue
+
+        value = ':'.join([macvalue[i:i + 2] for i in range(0, len(macvalue), 2)])
+        return value.lower()

stix_shifter_modules/splunk/stix_transmission/api_client.py

@@ -15,7 +15,7 @@ def __init__(self, connection, configuration):
         # This version of the Splunk APIClient is designed to function with
         # Splunk Enterprise version >= 6.5.0 and <= 7.1.2
         # http://docs.splunk.com/Documentation/Splunk/7.1.2/RESTREF/RESTprolog
-
+        
         self.output_mode = 'json'
         self.endpoint_start = 'services/'
         self.authenticated = False
@@ -30,9 +30,9 @@ def __init__(self, connection, configuration):
         self.headers = headers
         self.timeout = connection['options'].get('timeout')
 
-    def authenticate(self):
+    async def authenticate(self):
         if not self.authenticated:
-            self.set_splunk_auth_token(self.auth, self.headers)
+            await self.set_splunk_auth_token(self.auth, self.headers)
             self.authenticated = True
 
     async def set_splunk_auth_token(self, auth, headers):
@@ -45,16 +45,17 @@ async def set_splunk_auth_token(self, auth, headers):
         except KeyError as e:
             raise Exception('Authentication error occured while getting auth token: ' + str(e))
 
+
     async def ping_box(self):
-        self.authenticate()
+        await self.authenticate()
         endpoint = self.endpoint_start + 'server/status'
         data = {'output_mode': self.output_mode}
         return await self.client.call_api(endpoint, 'GET', data=data, timeout=self.timeout)
 
     async def create_search(self, query_expression):
         # sends a POST request to 
         # https://<server_ip>:<port>/services/search/jobs
-        self.authenticate()
+        await self.authenticate()
         endpoint = self.endpoint_start + "search/jobs"
         data = {'search': query_expression, 'output_mode': self.output_mode}
         return await self.client.call_api(endpoint, 'POST', data=data, timeout=self.timeout)
@@ -63,7 +64,7 @@ async def get_search(self, search_id):
         # sends a GET request to
         # https://<server_ip>:<port>/services/search/jobs/<search_id>
         # returns information about the search job and its properties.
-        self.authenticate()
+        await self.authenticate()
         endpoint = self.endpoint_start + 'search/jobs/' + search_id        
         data = {'output_mode': self.output_mode}        
         return await self.client.call_api(endpoint, 'GET', data=data, timeout=self.timeout)
@@ -72,7 +73,7 @@ async def get_search_results(self, search_id, offset, count):
         # sends a GET request to
         # https://<server_ip>:<port>/services/search/jobs/<search_id>/results
         # returns results associated with the search job.
-        self.authenticate()
+        await self.authenticate()
         endpoint = self.endpoint_start + "search/jobs/" + search_id + '/results'
         data = {'output_mode': self.output_mode}
         if ((offset is not None) and (count is not None)):
@@ -85,7 +86,7 @@ async def delete_search(self, search_id):
         # sends a DELETE request to
         # https://<server_ip>:<port>/services/search/jobs/<search_id>
         # cancels and deletes search created earlier.
-        self.authenticate()
+        await self.authenticate()
         endpoint = self.endpoint_start + 'search/jobs/' + search_id
         data = {'output_mode': self.output_mode}
         return await self.client.call_api(endpoint, 'DELETE', data=data, timeout=self.timeout)

stix_shifter_modules/splunk/tests/stix_translation/test_splunk_json_to_stix.py

@@ -24,6 +24,7 @@
 
 sample_splunk_data_x_oca = {
     "src_ip": "123.123.123.123",
+    "src_mac": "12-5d-6a-52.78",
     "src_port": "56109",
     "dest_ip": "1.1.1.1",
     "dest_port": "9389",
@@ -251,7 +252,6 @@ def test_process_cim_to_stix(self):
 
         proc_obj = TestTransform.get_first_of_type(objects.values(), 'process')
         assert (proc_obj is not None), 'process object type not found'
-        assert (proc_obj.keys() == {'type', 'name', 'pid', 'binary_ref'})
         assert (proc_obj['name'] == "test_process")
         assert (proc_obj['pid'] == 0)
 
@@ -721,5 +721,22 @@ def test_x_oca_asset(self):
         x_oca_asset = TestTransform.get_first_of_type(object_vals, 'x-oca-asset')
         self.assertEqual(x_oca_asset['hostname'], 'WIN01')
 
+
+    def test_mac_addr(self):
+        result_bundle = json_to_stix_translator.convert_to_stix(
+            data_source, map_data, [sample_splunk_data_x_oca], get_module_transformers(MODULE), options,
+            callback=hash_type_lookup)
+
+        assert (result_bundle['type'] == 'bundle')
+        result_bundle_objects = result_bundle['objects']
+        observed_data = result_bundle_objects[1]
+
+        assert ('objects' in observed_data)
+        objects = observed_data['objects']
+        object_vals = objects.values()
+
+        mac = TestTransform.get_first_of_type(object_vals, 'mac-addr')
+        self.assertEqual(mac['value'], '00:12:5d:6a:52:78')
+
 if __name__ == '__main__':
     unittest.main()