16
16
limitations under the License.
17
17
-----------------------------------------------------------------
18
18
"""
19
+ from typing import Union
19
20
20
21
from app .converter .backends .microsoft .const import microsoft_sentinel_query_details
21
22
from app .converter .backends .microsoft .mapping import MicrosoftSentinelMappings , microsoft_sentinel_mappings
28
29
class MicrosoftSentinelFieldValue (BaseQueryFieldValue ):
29
30
details : PlatformDetails = microsoft_sentinel_query_details
30
31
32
+ @staticmethod
33
+ def __escape_value (value : Union [int , str ]) -> Union [int , str ]:
34
+ return value .replace ("'" , "''" ) if isinstance (value , str ) else value
35
+
31
36
def equal_modifier (self , field , value ):
32
37
if isinstance (value , str ):
33
- return f"{ field } =~ @'{ value } '"
38
+ return f"{ field } =~ @'{ self . __escape_value ( value ) } '"
34
39
elif isinstance (value , list ):
35
- prepared_values = ", " .join (f"@'{ v } '" for v in value )
40
+ prepared_values = ", " .join (f"@'{ self . __escape_value ( v ) } '" for v in value )
36
41
operator = "in~" if all (isinstance (v , str ) for v in value ) else "in"
37
42
return f'{ field } { operator } ({ prepared_values } )'
38
43
return f'{ field } == { value } '
39
44
40
45
def contains_modifier (self , field , value ):
41
46
if isinstance (value , list ):
42
47
return f"({ self .or_token .join (self .contains_modifier (field = field , value = v ) for v in value )} )"
43
- return f"{ field } contains @'{ value } '"
48
+ return f"{ field } contains @'{ self . __escape_value ( value ) } '"
44
49
45
50
def endswith_modifier (self , field , value ):
46
51
if isinstance (value , list ):
47
52
return f"({ self .or_token .join (self .endswith_modifier (field = field , value = v ) for v in value )} )"
48
- return f"{ field } endswith @'{ value } '"
53
+ return f"{ field } endswith @'{ self . __escape_value ( value ) } '"
49
54
50
55
def startswith_modifier (self , field , value ):
51
56
if isinstance (value , list ):
52
57
return f"({ self .or_token .join (self .startswith_modifier (field = field , value = v ) for v in value )} )"
53
- return f"{ field } startswith @'{ value } '"
58
+ return f"{ field } startswith @'{ self . __escape_value ( value ) } '"
54
59
55
60
def __regex_modifier (self , field , value ):
56
- return f"{ field } matches regex @'(?i){ value } '"
61
+ return f"{ field } matches regex @'(?i){ self . __escape_value ( value ) } '"
57
62
58
63
def regex_modifier (self , field , value ):
59
64
if isinstance (value , list ):
@@ -63,7 +68,7 @@ def regex_modifier(self, field, value):
63
68
def keywords (self , field , value ):
64
69
if isinstance (value , list ):
65
70
return f"({ self .or_token .join (self .keywords (field = field , value = v ) for v in value )} )"
66
- return f"* contains @'{ value } '"
71
+ return f"* contains @'{ self . __escape_value ( value ) } '"
67
72
68
73
69
74
class MicrosoftSentinelQueryRender (BaseQueryRender ):
@@ -78,14 +83,11 @@ class MicrosoftSentinelQueryRender(BaseQueryRender):
78
83
79
84
mappings : MicrosoftSentinelMappings = microsoft_sentinel_mappings
80
85
comment_symbol = "//"
86
+ is_multi_line_comment = True
81
87
82
88
def generate_prefix (self , log_source_signature : LogSourceSignature ) -> str :
83
89
return str (log_source_signature )
84
90
85
- def render_not_supported_functions (self , not_supported_functions : list ) -> str :
86
- render_not_suported = "\n " .join ([f'// { i } ' for i in not_supported_functions ])
87
- return "\n \n " + f"// { self .unsupported_functions_text } " + render_not_suported
88
-
89
91
def generate_functions (self , functions : list ) -> str :
90
92
if not functions :
91
93
return ""
0 commit comments