Added Darktrace UDI connector.

[lakshmi51974368]

Added Darktrace UDI connector.

[codecov]

Codecov Report

Merging #896 (75a9628) into develop (336ca33) will increase coverage by 0.05%.
The diff coverage is 95.84%.

@@             Coverage Diff             @@
##           develop     #896      +/-   ##
===========================================
+ Coverage    64.65%   64.70%   +0.05%     
===========================================
  Files          506      517      +11     
  Lines        47017    48583    +1566     
===========================================
+ Hits         30399    31437    +1038     
- Misses       16618    17146     +528     

Impacted Files	Coverage Δ
...modules/darktrace/stix_translation/transformers.py	73.91% <85.00%> (ø)
...es/darktrace/stix_translation/query_constructor.py	78.60% <90.95%> (ø)
...r_modules/darktrace/stix_transmission/connector.py	78.66% <92.91%> (ø)
...t/stix_translation/test_darktrace_stix_to_query.py	72.39% <96.98%> (ø)
...st/stix_translation/test_darktrace_json_to_stix.py	46.24% <98.50%> (ø)
stix_shifter_modules/darktrace/entry_point.py	100.00% <100.00%> (ø)
...les/darktrace/stix_translation/query_translator.py	81.81% <100.00%> (ø)
...s/darktrace/stix_translation/results_translator.py	100.00% <100.00%> (ø)
..._modules/darktrace/stix_transmission/api_client.py	78.72% <100.00%> (ø)
...odules/darktrace/stix_transmission/error_mapper.py	90.90% <100.00%> (ø)
... and 2 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 336ca33...75a9628. Read the comment docs.

[mdazam1942]

I see some extra parentheses used in the translated queries. for example-
[file:name = 'some_file.exe' OR file:name = 'ttest']
Translates into -
((@fields.filename:\"ttest\") OR (@fields.filename:\"some_file.exe\")) AND (@fields.epochdate :>1651864110.097 AND @fields.epochdate :<1651864410.097))

Unless the api asks for those extra parentheses, I think you can optimize the use of parentheses () for example the above can be optimized into -

(@fields.filename:\"ttest\" OR @fields.filename:\"some_file.exe\") AND (@fields.epochdate :>1651864110.097 AND @fields.epochdate :<1651864410.097)

[lakshmi51974368]

I see some extra parentheses used in the translated queries. for example- [file:name = 'some_file.exe' OR file:name = 'ttest'] Translates into - ((@fields.filename:\"ttest\") OR (@fields.filename:\"some_file.exe\")) AND (@fields.epochdate :>1651864110.097 AND @fields.epochdate :<1651864410.097))

Unless the api asks for those extra parentheses, I think you can optimize the use of parentheses () for example the above can be optimized into -

(@fields.filename:\"ttest\" OR @fields.filename:\"some_file.exe\") AND (@fields.epochdate :>1651864110.097 AND @fields.epochdate :<1651864410.097)

Fixed the above the issue:

1. Unwanted parentheses for single query statement is removed.
2. Overall query parentheses is not removed. ex:(query)
   Note: Query consists of multiple statements with AND and OR operators, parentheses are required as per API requirement.

Current code change will give a below results.
((@fields.filename:"ttest" OR @fields.filename:"some_file.exe") AND
(@fields.epochdate :>1652075635.723 AND @fields.epochdate :<1652075935.723))