Small fix for integer values. (#1736)

* Small fix for integer values. Signed-off-by: DerekRushton <[email protected]> * Fixing the unit test. Signed-off-by: DerekRushton <[email protected]> --------- Signed-off-by: DerekRushton <[email protected]>
opencybersecurityalliance · Sep 19, 2024 · ea56c67 · ea56c67
1 parent 80f3b37
commit ea56c67
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/stix_shifter_modules/crowdstrike_alerts/stix_translation/query_constructor.py b/stix_shifter_modules/crowdstrike_alerts/stix_translation/query_constructor.py
@@ -50,7 +50,9 @@ def _parse_mapped_fields(self, value, comparator, mapped_fields_array) -> str:
         comparison_strings = []
 
         if isinstance(value, str):
-                value = [value]
+            value = [value]
+        if isinstance(value,int):
+            value = [value]
         for val in value:
             for mapped_field in mapped_fields_array:
                 comparison_strings.append(f"{mapped_field}{comparator} '{val}'")

diff --git a/...oint_security_hx/test/stix_translation/test_trellix_endpoint_security_hx_stix_to_query.py b/...oint_security_hx/test/stix_translation/test_trellix_endpoint_security_hx_stix_to_query.py
@@ -362,7 +362,7 @@ def test_multiple_observation_with_single_qualifier_with_precedence_bracket(self
         self._test_query_assertions(query, queries)
 
     def test_future_timestamp_qualifier(self):
-        stix_pattern = "[network-traffic:src_port < 53]START t'2024-09-19T11:00:00.000Z' " \
+        stix_pattern = "[network-traffic:src_port < 53]START t'2027-09-19T11:00:00.000Z' " \
                        "STOP t'2024-02-07T11:00:00.003Z'"
         result = translation.translate('trellix_endpoint_security_hx', 'query', '{}', stix_pattern,
                                        {"host_sets": "host_set1"})