Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

QRadar - Remove Zero Values from IP and Mac Results #1468

Merged
merged 4 commits into from
May 11, 2023
Merged

QRadar - Remove Zero Values from IP and Mac Results #1468

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
15db64d
Remove Zero Values from Results
KaneBrennan132 May 5, 2023
1cde361
Check for no refs in network-traffic for unit test
KaneBrennan132 May 10, 2023
7e4e466
Merge branch 'develop' into develop_Qradar_Filter_Zero_Values
KaneBrennan132 May 10, 2023
493134d
Merge branch 'develop' into develop_Qradar_Filter_Zero_Values
delliott90 May 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions stix_shifter_modules/qradar/stix_translation/results_translator.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,4 +22,32 @@ def translate_results(self, data_source, data):
if result.get('flowdestinationpayload'):
result['mime_type_flowdestinationpayload'] = 'application/octet-stream'

if result.get('sourceip'):
if result['sourceip'] == '0.0.0.0':
result['sourceip'] = None

if result.get('destinationip'):
if result['destinationip'] == '0.0.0.0':
result['destinationip'] = None

if result.get('sourcemac'):
if result['sourcemac'] == '00:00:00:00:00:00' or result['sourcemac'] == '00-00-00-00-00-00':
result['sourcemac'] = None

if result.get('destinationmac'):
if result['destinationmac'] == '00:00:00:00:00:00' or result['destinationmac'] == '00-00-00-00-00-00':
result['destinationmac'] = None

if result.get('identityip'):
if result['identityip'] == '0.0.0.0':
result['identityip'] = None

if result.get('sourcev6'):
if result['sourcev6'] == '0:0:0:0:0:0:0:0':
result['sourcev6'] = None

if result.get('destinationv6'):
if result['destinationv6'] == '0:0:0:0:0:0:0:0':
result['destinationv6'] = None

return super().translate_results(data_source, results)
34 changes: 33 additions & 1 deletion stix_shifter_modules/qradar/tests/stix_translation/test_qradar_json_to_stix.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -633,4 +633,36 @@ def test_epoch_exponent_notation(self):
finding = TestTransform.get_first_of_type(objects.values(), 'x-ibm-finding')

assert(finding['start'] == START_TIMESTAMP)
assert(finding['end'] == END_TIMESTAMP)
assert(finding['end'] == END_TIMESTAMP)

def test_zero_value_filtering(self):

data = [{
"qidname": "Information Message",
"sourceip": "0.0.0.0",
"destinationip": "0.0.0.0",
"sourcemac": "00-00-00-00-00-00",
"destinationmac": "00-00-00-00-00-00",
"identityip": "0.0.0.0",
"sourcev6": "0:0:0:0:0:0:0:0",
"destinationv6": "0:0:0:0:0:0:0:0",
"sourceport": "1234",
"destinationport": "1234"
}]

result_bundle = run_in_thread(entry_point.translate_results, DATA_SOURCE, data)
observed_data = result_bundle['objects'][1]
objects = observed_data['objects']

ipv4_addr = TestTransform.get_first_of_type(objects.values(), 'ipv4-addr')
assert(ipv4_addr is None)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These tests are good. Can you confirm that in these cases, the network-traffic object isn't referencing a missing ipv4 or ipv6 object (as either src_ref or dst_ref) because it was only contained zeros?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The network-traffic object does not referencing a missing ipv4 or ipv6 object (as either src_ref or dst_ref) after these changes. As an example I can provide an example from my testing.

Here is an example from before the changes:
{ "id": "observed-data--98a6d37c-4eea-4a8b-9cd1-338dd585001e", "type": "observed-data", "created_by_ref": "identity--5f7315e6-f5da-4a0c-9418-1a205b31a9cb", "created": "2023-04-24T09:22:09.303Z", "modified": "2023-04-24T09:22:09.303Z", "objects": { "0": { "type": "x-oca-event", "action": "Deny protocol src", "outcome": "Firewall Deny", "category": [ "Access" ], "provider": "Cisco Firewall Services Module (FWSM)", "agent": "FWSM @ 127.0.0.1", "created": "2023-04-24T08:59:09.008Z", "network_ref": "4", "host_ref": "5", "original_ref": "10" }, "1": { "type": "x-qradar", "qid": 3503015, "category_id": 4003, "high_level_category_id": 4000, "log_source_id": 262, "device_type": 31, "direction": "R2R", "credibility": 5, "relevance": 1, "cre_event_list": [ "100022", "100090", "100153", "100135", "100093", "100241", "100249", "100246", "104955", "107055", "100211", "100207", "100205" ], "domain_id": 0, "domain_name": "Default Domain", "has_offense": "false" }, "2": { "type": "x-ibm-finding", "start": "2023-04-24T08:59:09.008Z", "end": "2023-04-24T08:59:09.008Z", "src_ip_ref": "3", "dst_ip_ref": "7", "event_count": 1, "finding_type": "event", "magnitude": 4, "severity": 6, "src_geolocation": "other", "dst_geolocation": "other", "rule_names": [ "BB:ProtocolDefinition: Windows Protocols", "BB:NetworkDefinition: Honeypot like Addresses", "BB:CategoryDefinition: Suspicious Event Categories", "BB:CategoryDefinition: Suspicious Events", "BB:CategoryDefinition: Firewall or ACL Denies", "BB:DeviceDefinition: FW / Router / Switch", "BB:NetworkDefinition: Darknet Addresses", "Load Basic Building Blocks", "BB:UBA : Common Log Source Filters", "BB:UBA : Access Denies", "Source Asset Weight is Low", "Source Address is a Bogon IP", "Destination Asset Weight is Low" ] }, "3": { "type": "ipv4-addr", "value": "0.0.0.0", "resolves_to_refs": [ "6" ] }, "4": { "type": "network-traffic", "src_ref": "3", "src_port": 1234, "dst_ref": "7", "dst_port": 1234, "protocols": [ "udp" ] }, "6": { "type": "mac-addr", "value": "00:00:00:00:00:00" }, "7": { "type": "ipv4-addr", "value": "0.0.0.0", "resolves_to_refs": [ "8" ] }, "8": { "type": "mac-addr", "value": "00:00:00:00:00:00" }, "9": { "type": "ipv4-addr", "value": "0.0.0.0" }, "10": { "type": "artifact", "payload_bin": "JUZXU00tNC0xMDYwMjM6IERlbnkgdWRwIHNyYyBvdXRzaWRlOjAuMC4wLjAvMTIzNCBkc3QgaW5zaWRlLTEwNDowLjAuMC4wLzEyMzQgYnkgYWNjZXNzLWdyb3VwICJJTlNJREVfT1VUIg0K", "mime_type": "text/plain" } }, "first_observed": "2023-04-24T08:59:09.008Z", "last_observed": "2023-04-24T08:59:09.008Z", "number_observed": 1 }

After the changes, the bundle is now like this:

{ "id": "observed-data--e9bc98c9-3c21-4cc1-8f47-0a482e1ab671", "type": "observed-data", "created_by_ref": "identity--2f68d422-8ed9-4d90-a1c2-4d72db5cbb67", "created": "2023-04-24T09:04:51.393Z", "modified": "2023-04-24T09:04:51.393Z", "objects": { "0": { "type": "x-oca-event", "action": "Deny protocol src", "outcome": "Firewall Deny", "category": [ "Access" ], "provider": "Cisco Firewall Services Module (FWSM)", "agent": "FWSM @ 127.0.0.1", "created": "2023-04-24T08:59:09.008Z", "original_ref": "4" }, "1": { "type": "x-qradar", "qid": 3503015, "category_id": 4003, "high_level_category_id": 4000, "log_source_id": 262, "device_type": 31, "direction": "R2R", "credibility": 5, "relevance": 1, "cre_event_list": [ "100022", "100090", "100153", "100135", "100093", "100241", "100249", "100246", "104955", "107055", "100211", "100207", "100205" ], "domain_id": 0, "domain_name": "Default Domain", "has_offense": "false" }, "2": { "type": "x-ibm-finding", "start": "2023-04-24T08:59:09.008Z", "end": "2023-04-24T08:59:09.008Z", "event_count": 1, "finding_type": "event", "magnitude": 4, "severity": 6, "src_geolocation": "other", "dst_geolocation": "other", "rule_names": [ "BB:ProtocolDefinition: Windows Protocols", "BB:NetworkDefinition: Honeypot like Addresses", "BB:CategoryDefinition: Suspicious Event Categories", "BB:CategoryDefinition: Suspicious Events", "BB:CategoryDefinition: Firewall or ACL Denies", "BB:DeviceDefinition: FW / Router / Switch", "BB:NetworkDefinition: Darknet Addresses", "Load Basic Building Blocks", "BB:UBA : Common Log Source Filters", "BB:UBA : Access Denies", "Source Asset Weight is Low", "Source Address is a Bogon IP", "Destination Asset Weight is Low" ] }, "3": { "type": "network-traffic", "src_port": 1234, "dst_port": 1234, "protocols": [ "udp" ] }, "4": { "type": "artifact", "payload_bin": "JUZXU00tNC0xMDYwMjM6IERlbnkgdWRwIHNyYyBvdXRzaWRlOjAuMC4wLjAvMTIzNCBkc3QgaW5zaWRlLTEwNDowLjAuMC4wLzEyMzQgYnkgYWNjZXNzLWdyb3VwICJJTlNJREVfT1VUIg0K", "mime_type": "text/plain" } }, "first_observed": "2023-04-24T08:59:09.008Z", "last_observed": "2023-04-24T08:59:09.008Z", "number_observed": 1 }

The network-traffic object does not reference any missing ipv4 object after the changes.

I'll add to the test to check that there are no references.

ipv6_addr = TestTransform.get_first_of_type(objects.values(), 'ipv6-addr')
assert(ipv6_addr is None)
mac_addr = TestTransform.get_first_of_type(objects.values(), 'mac-addr')
assert(mac_addr is None)
x_oca_event = TestTransform.get_first_of_type(objects.values(), 'x-oca-event')
assert(x_oca_event['action'] == "Information Message")
network_traffic = TestTransform.get_first_of_type(objects.values(), 'network-traffic')
assert(network_traffic is not None)
assert('src_ref' not in network_traffic)
assert('dst_ref' not in network_traffic)