Skip to content

Commit 4e8fe1b

Browse files
mdazam1942mdazam1942
authored
Instructions for the usage of custom mappings (#1274)
1 parent 98650c3 commit 4e8fe1b

File tree

39 files changed

+188
-90
lines changed

39 files changed

+188
-90
lines changed

‎README.md

+4
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,11 @@ response = translation.translate('<MODULE NAME>', 'query', '{}', '<STIX PATTERN>
9191
9292
print(response)
9393
```
94+
### Use of custom mappings
9495

96+
If a connector has been installed using pip, the process for editing the STIX mappings is different than if you have pulled-down the project. When working locally, you can edit the mapping files directly. See the [mapping files for the MySQL connector](stix_shifter_modules/mysql/stix_translation/json) as an example. Editing the mapping files won't work if the connector has been installed with pip; the setup script of the stix-shifter package includes the mapppings inside `config.json`. This allows stix-shifter to injest custom mappings as part of the connector's configuration.
97+
98+
Refer to [Use of custom mappings](https://github.com/opencybersecurityalliance/stix-shifter/blob/develop/adapter-guide/custom_mappings.md) for more details on how to edit the mappings in the configuration.
9599

96100
## Contributing
97101

‎adapter-guide/custom_mappings.md

+94
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# Use of custom mappings
2+
3+
Follow the below steps, if a user or threat hunter wants to use custom mapping after installing stix-shifter libraries:
4+
5+
6+
1. Go to the standard python library installation location. The installation path usually looks like this ***lib/pythonX.Y/site-packages*** or go to https://docs.python.org/3/install/ for more details on the python library installation based on your system.
7+
8+
2. Go to the ***stix_shifter_modules*** folder and find the connector name that is installed.
9+
10+
3. Inside the connector folder, go to the ***config.json*** file found under the ***stix_shifter_modules/\<CONNECTOR\>/configuration/*** directory.
11+
12+
4. There is a `mapping` object nested inside the `options` JSON object. This includes all the mappings from the `from_stix` and `to_stix` mapping files. Here's an example of the `config.json` file:
13+
14+
```
15+
{
16+
"connection": {
17+
"type": {
18+
"displayName": "MySQL",
19+
"group": "mysql",
20+
"type": "connectorType"
21+
},
22+
"options": {
23+
"mapping": {
24+
"type": "json",
25+
"optional": true,
26+
"previous": "connection.mapping",
27+
"default": {
28+
"from_stix_map": {
29+
"ipv4-addr": {
30+
"fields": {
31+
"value": [
32+
"source_ipaddr",
33+
"dest_ipaddr"
34+
]
35+
}
36+
},
37+
"file": {
38+
"fields": {
39+
"name": [
40+
"filename"
41+
]
42+
}
43+
}
44+
},
45+
"operators": {
46+
"ComparisonExpressionOperators.And": "AND",
47+
"ComparisonExpressionOperators.Or": "OR"
48+
},
49+
"to_stix_map": {
50+
"source_ipaddr": [
51+
{
52+
"key": "ipv4-addr.value",
53+
"object": "src_ip"
54+
},
55+
{
56+
"key": "network-traffic.src_ref",
57+
"object": "nt",
58+
"references": "src_ip"
59+
}
60+
],
61+
"dest_ipaddr": [
62+
{
63+
"key": "ipv4-addr.value",
64+
"object": "dst_ip"
65+
},
66+
{
67+
"key": "network-traffic.dst_ref",
68+
"object": "nt",
69+
"references": "dst_ip"
70+
}
71+
]
72+
}
73+
}
74+
}
75+
}
76+
},
77+
"configuration": {
78+
"auth": {
79+
"type": "fields",
80+
"username": {
81+
"type": "password"
82+
},
83+
"password": {
84+
"type": "password"
85+
}
86+
}
87+
}
88+
}
89+
```
90+
91+
92+
5. You can change, update or use the existing custom mappings fields and save the file.
93+
94+
6. The stix-shifter CLI commands should automatically pick up your custom mappings in the next command execution.

‎adapter-guide/develop-configuration-json.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -126,11 +126,11 @@ Below example json is the language translation file of the above QRadar config j
126126
"host": {
127127
"label": "Management IP address or Hostname",
128128
"placeholder": "192.168.1.10",
129-
"description": "Specify the IP address or hostname of the data source so that IBM Cloud Pak for Security can communicate with it"
129+
"description": "Specify the IP address or hostname of the data source"
130130
},
131131
"port": {
132132
"label": "Host Port",
133-
"description": "Set the port number that is associated with the Host name or IP"
133+
"description": "Set the port number that is associated with the host name or IP address"
134134
},
135135
"help": {
136136
"label": "Need additional help?",

‎stix_shifter_modules/alertflex/configuration/lang_en.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"connection": {
33
"host": {
4-
"label": "Management IP address or Hostname",
4+
"label": "Management IP address or hostname",
55
"placeholder": "192.168.1.10",
6-
"description": "Specify the IP address or hostname of the Alertflex controller"
6+
"description": "Specify the IP address or hostname of the data source"
77
},
88
"port": {
99
"label": "Host Port",
10-
"description": "Set the port number that is associated with the Host name or IP"
10+
"description": "Set the port number that is associated with the hostname or IP address"
1111
},
1212
"help": {
1313
"label": "Help",

‎stix_shifter_modules/arcsight/configuration/lang_en.json

+7-7
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
11
{
22
"connection": {
33
"host": {
4-
"label": "ArcSight Logger IP address or Hostname",
5-
"description": "Use IP address or Hostname of the ArcSight logger"
4+
"label": "Management IP address or hostname",
5+
"description": "Specify the IP address or hostname of the data source"
66
},
77
"port": {
88
"label": "Host Port",
9-
"description": "Set the port number that is associated with the Host name or IP"
9+
"description": "Set the port number that is associated with the hostname or IP address"
1010
},
1111
"help": {
1212
"label": "Need additional help?",
1313
"description": "More details on the datasource setting can be found in the specified link"
1414
},
1515
"selfSignedCert": {
16-
"label": "ArcSight logger Connection Certificate",
17-
"description": "Use self-signed SSL certificate and CA content(root and intermediate) of datasource"
16+
"label": "Connection Certificate",
17+
"description": "Use self-signed SSL certificate and CA content (root and intermediate) of datasource"
1818
},
1919
"sni": {
2020
"label": "Server Name Indicator",
@@ -24,11 +24,11 @@
2424
"configuration": {
2525
"auth": {
2626
"login": {
27-
"label": "ArcSight Logger Username",
27+
"label": "Username",
2828
"description": "ArcSight Logger user's login name with access to the search API"
2929
},
3030
"password": {
31-
"label": "ArcSight Logger Password",
31+
"label": "Password",
3232
"description": "ArcSight Logger user's password with access to the search API"
3333
}
3434
}

‎stix_shifter_modules/async_template/configuration/lang_en.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"connection": {
33
"host": {
4-
"label": "Management IP address or Hostname",
4+
"label": "Management IP address or hostname",
55
"placeholder": "192.168.1.10",
6-
"description": "Specify the IP address or hostname of the data source so that IBM Cloud Pak for Security can communicate with it"
6+
"description": "Specify the IP address or hostname of the data source"
77
},
88
"port": {
99
"label": "Host Port",
10-
"description": "Set the port number that is associated with the Host name or IP"
10+
"description": "Set the port number that is associated with the hostname or IP address"
1111
},
1212
"help": {
1313
"label": "Need additional help?",

‎stix_shifter_modules/azure_sentinel/configuration/lang_en.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"connection": {
33
"host": {
4-
"label": "Management IP address or Hostname",
5-
"description": "Specify the IP address or hostname of the data source so that IBM Cloud Pak for Security can communicate with it"
4+
"label": "Management IP address or hostname",
5+
"description": "Specify the IP address or hostname of the data source"
66
},
77
"port": {
88
"label": "Host Port",
9-
"description": "Set the port number that is associated with the Host name or IP"
9+
"description": "Set the port number that is associated with the hostname or IP address"
1010
},
1111
"help": {
1212
"label": "Need additional help?",

‎stix_shifter_modules/bigfix/configuration/lang_en.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"connection": {
33
"host": {
4-
"label": "Management IP address or Hostname",
4+
"label": "Management IP address or hostname",
55
"placeholder": "192.168.1.10",
6-
"description": "Specify the IP address or hostname of the data source so that IBM Cloud Pak for Security can communicate with it"
6+
"description": "Specify the IP address or hostname of the data source"
77
},
88
"port": {
99
"label": "Host Port",
10-
"description": "Set the port number that is associated with the Host name or IP"
10+
"description": "Set the port number that is associated with the hostname or IP address"
1111
},
1212
"help": {
1313
"label": "Need additional help?",

‎stix_shifter_modules/carbonblack/configuration/lang_en.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"connection": {
33
"host": {
4-
"label": "Management IP address or Hostname",
4+
"label": "Management IP address or hostname",
55
"placeholder": "192.168.1.10",
6-
"description": "Specify the IP address or hostname of the data source so that IBM Cloud Pak for Security can communicate with it"
6+
"description": "Specify the IP address or hostname of the data source"
77
},
88
"port": {
99
"label": "Host Port",
10-
"description": "Set the port number that is associated with the Host name or IP"
10+
"description": "Set the port number that is associated with the hostname or IP address"
1111
},
1212
"help": {
1313
"label": "Need additional help?",

‎stix_shifter_modules/cbcloud/configuration/lang_en.json

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
{
22
"connection": {
33
"host": {
4-
"label": "Management IP address or Hostname",
4+
"label": "Management IP address or hostname",
55
"placeholder": "192.168.1.10",
6-
"description": "Specify the IP address or hostname of the Carbon Black Cloud instance so that IBM Cloud Pak for Security can communicate with it."
6+
"description": "Specify the IP address or hostname of the data source"
77
},
88
"port": {
99
"label": "Host Port",
10-
"description": "Set the port number that is associated with the Host name or IP."
10+
"description": "Set the port number that is associated with the hostname or IP address"
1111
},
1212
"help": {
1313
"label": "Need additional help?",
14-
"description": "More details on the data source setting can be found in the specified link."
14+
"description": "More details on the data source setting can be found in the specified link"
1515
}
1616
},
1717
"configuration": {

‎stix_shifter_modules/crowdstrike/configuration/lang_en.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"connection": {
33
"host": {
4-
"label": "Management IP address or Hostname",
4+
"label": "Management IP address or hostname",
55
"placeholder": "192.168.1.10",
6-
"description": "Specify the IP address or hostname of the data source so that IBM Cloud Pak for Security can communicate with it"
6+
"description": "Specify the IP address or hostname of the data source"
77
},
88
"port": {
99
"label": "Host Port",
10-
"description": "Set the port number that is associated with the Host name or IP"
10+
"description": "Set the port number that is associated with the hostname or IP address"
1111
},
1212
"help": {
1313
"label": "Need additional help?",

‎stix_shifter_modules/cybereason/configuration/lang_en.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"connection": {
33
"host": {
4-
"label": "Management IP address or Hostname",
4+
"label": "Management IP address or hostname",
55
"placeholder": "192.168.1.10",
66
"description": "Specify the IP address or hostname of the data source"
77
},
88
"port": {
99
"label": "Host Port",
10-
"description": "Set the port number that is associated with the Host name or IP"
10+
"description": "Set the port number that is associated with the hostname or IP address"
1111
},
1212
"help": {
1313
"label": "Need additional help?",

‎stix_shifter_modules/darktrace/configuration/lang_en.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"connection": {
33
"host": {
4-
"label": "Management IP address or Hostname",
4+
"label": "Management IP address or hostname",
55
"description": "Specify the IP address or hostname of the data source"
66
},
77
"help": {

‎stix_shifter_modules/datadog/configuration/lang_en.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"site_url": {
44
"label": "Site URL",
55
"placeholder": "https://app.datadoghq.com",
6-
"description": "Specify the Site URL of the Datadog so that IBM Cloud Pak for Security can communicate with it"
6+
"description": "Specify the Site URL of the datasource"
77
},
88
"selfSignedCert": {
99
"label": "Datadog Certificate",

‎stix_shifter_modules/demo_template/configuration/lang_en.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"connection": {
33
"host": {
4-
"label": "Management IP address or Hostname",
4+
"label": "Management IP address or hostname",
55
"placeholder": "192.168.1.10",
6-
"description": "Specify the IP address or hostname of the data source so that the Application can communicate with it"
6+
"description": "Specify the IP address or hostname of the data source"
77
},
88
"port": {
99
"label": "Host Port",
10-
"description": "Set the port number that is associated with the Host name or IP"
10+
"description": "Set the port number that is associated with the hostname or IP address"
1111
},
1212
"help": {
1313
"label": "Need additional help?",

‎stix_shifter_modules/elastic_ecs/configuration/lang_en.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"connection": {
33
"host": {
4-
"label": "Management IP address or Hostname",
4+
"label": "Management IP address or hostname",
55
"placeholder": "192.168.1.10",
6-
"description": "Specify the IP address or hostname of the data source so that IBM Cloud Pak for Security can communicate with it"
6+
"description": "Specify the IP address or hostname of the data source"
77
},
88
"port": {
99
"label": "Host Port",
10-
"description": "Set the port number that is associated with the Host name or IP"
10+
"description": "Set the port number that is associated with the hostname or IP address"
1111
},
1212
"help": {
1313
"label": "Need additional help?",

‎stix_shifter_modules/error_test/configuration/lang_en.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"url": {
44
"label": "Full URL of a stix-bundle file",
55
"placeholder": "https://url.to.stix_bundle.json.file",
6-
"description": "Specify the URL of the STIX Bundle JSON file so that IBM Cloud Pak for Security can communicate with it"
6+
"description": "Specify the URL of the STIX Bundle JSON file"
77
},
88
"help": {
99
"label": "Need additional help?",

‎stix_shifter_modules/gcp_chronicle/configuration/lang_en.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"connection": {
33
"host": {
4-
"label": "Management IP address or Hostname",
4+
"label": "Management IP address or hostname",
55
"description": "Specify the IP address or hostname of the data source"
66
},
77
"help": {

‎stix_shifter_modules/guardium/configuration/lang_en.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"connection": {
33
"host": {
4-
"label": "Management IP address or Hostname",
4+
"label": "Management IP address or hostname",
55
"placeholder": "192.168.1.10",
6-
"description": "Specify the IP address or hostname of the data source so that IBM Cloud Pak for Security can communicate with it"
6+
"description": "Specify the IP address or hostname of the data source"
77
},
88
"port": {
99
"label": "Host Port",
10-
"description": "Set the port number that is associated with the Host name or IP"
10+
"description": "Set the port number that is associated with the hostname or IP address"
1111
},
1212
"help": {
1313
"label": "Need additional help?",

‎stix_shifter_modules/ibm_security_verify/configuration/lang_en.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
{
22
"connection": {
33
"host": {
4-
"label": "Management IP address or Hostname",
4+
"label": "Management IP address or hostname",
55
"placeholder": "192.168.1.1",
6-
"description": "Specify the IBM Security verify IP address or Hostname."
6+
"description": "Specify the data source IP address or hostname."
77
},
88
"port": {
99
"label": "Host Port",

0 commit comments

Comments
 (0)