AWS GuardDuty UDI Connector #1525

SharmilaMS-Hcl · 2023-07-11T17:15:00Z

Added files for AWS GuardDuty UDI Connector module
Added the following files related to PR Framework Changes for Handling Nested List of Dictionaries #1516 to avoid CI failures.
1. json_to_stix_translator.py
2. gcp chronicle Read me, to-stix and unit test case files
3. Reaqta unit test case file.
Updated stix_shifter.py file for handling serialization failure of datetime.datetime object.

1. Added files for AWS GuardDuty UDI Connector module 2. Added the following files related to PR opencybersecurityalliance#1516 to avoid CI failures. 1. json_to_stix_translator.py 2. gcp chronicle Read me, to-stix and unit test case files 3. Reaqta unit test case file. 3. Updated stix_shifter.py file for handling serialization failure of datetime.datetime object.

codecov · 2023-07-11T17:20:13Z

Codecov Report

Patch coverage: 93.42% and project coverage change: +0.22 🎉

Comparison is base (60c24b2) 85.32% compared to head (c324de0) 85.55%.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #1525      +/-   ##
===========================================
+ Coverage    85.32%   85.55%   +0.22%     
===========================================
  Files          672      682      +10     
  Lines        54088    55564    +1476     
===========================================
+ Hits         46152    47536    +1384     
- Misses        7936     8028      +92

Impacted Files	Coverage Δ
...es/aws_guardduty/stix_transmission/boto3_client.py	`25.00% <25.00%> (ø)`
...les/aws_guardduty/stix_translation/transformers.py	`66.66% <66.66%> (ø)`
...es/aws_guardduty/stix_transmission/error_mapper.py	`85.00% <85.00%> (ø)`
...ws_guardduty/stix_translation/query_constructor.py	`91.31% <91.31%> (ø)`
...dules/aws_guardduty/stix_transmission/connector.py	`92.57% <92.57%> (ø)`
...ix_translation/test_aws_guardduty_stix_to_query.py	`99.53% <99.53%> (ø)`
stix_shifter_modules/aws_guardduty/entry_point.py	`100.00% <100.00%> (ø)`
...aws_guardduty/stix_translation/query_translator.py	`100.00% <100.00%> (ø)`
...tix_translation/test_aws_guardduty_json_to_stix.py	`100.00% <100.00%> (ø)`
...duty/tests/stix_transmission/test_aws_guardduty.py	`100.00% <100.00%> (ø)`

... and 1 file with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

mdazam1942 · 2023-07-12T18:44:53Z

stix_shifter_modules/aws_guardduty/configuration/lang_en.json

+        },
+        "detector_ids": {
+            "label": "Detector Ids",
+            "description": "Detector id of the GuardDuty"


Description needs to be more clear. According to this comment #1516 (comment)

You may have to show an example of how to specify the ids.

Updated the description of the detector id with an example.

Updated file with detailed description for Detector Ids

stix_shifter_modules/aws_guardduty/stix_translation/json/to_stix_map.json

stix_shifter_modules/aws_guardduty/stix_translation/json/stix_2_1/to_stix_map.json

mdazam1942 · 2023-07-13T18:25:24Z

stix_shifter_modules/aws_guardduty/stix_translation/json/to_stix_map.json

+  },
+  "AccountId": [
+    {
+      "key": "x-aws.account_id",


all the x-aws mappings can go under x-aws-resource

Basically, x-aws-resource has been used to map the affected resources in the finding. Since account id and region are related to AWS cloud subscription and common to all findings, these fields are mapped under separate object x-aws. Kindly let us know, your comments in this.

i think its unnecessary to create x-aws object just for accounts. Account information are basically related to aws resources so I think x-aws-resource should be the right object unless there are multiple account ids mapped.

Updated the mappings as suggested.

1. Removed Cybox attribute from the to-stix file. 2. Updated supported Stix mappings.

Updated the mapping files, unit test cases, read me and supported stix files by modifying account id and region related details to x-aws-resource.

…ain_pr

SharmilaMS-Hcl mentioned this pull request Jul 11, 2023

Framework Changes for Handling Nested List of Dictionaries #1516

Merged

mdazam1942 reviewed Jul 12, 2023

View reviewed changes

Updated lang_en.json

71534cd

Updated file with detailed description for Detector Ids