-
Notifications
You must be signed in to change notification settings - Fork 229
Open
Labels
bugSomething isn't workingSomething isn't working
Description
Describe the bug
Some connectors (like qradar) are adding wildcards to the start and end of the user's value when translating the LIKE
operator. The LIKE
operator comes from SQL, according to https://docs.oasis-open.org/cti/stix/v2.0/cs01/part5-stix-patterning/stix-v2.0-cs01-part5-stix-patterning.html#_Toc496717750
stix-shifter should use the pattern supplied by the user with as little modification as necessary. If the user wants wildcards at the start and end, they can add them.
Example:
def _format_like(value) -> str: |
Expected behavior
Perform the search the user asked for, without changing its meaning.
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working