LIKE operator has wildcards added to it in some connector modules
Opened this issue · 0 comments
pcoccoli commented
Describe the bug
Some connectors (like qradar) are adding wildcards to the start and end of the user's value when translating the LIKE
operator. The LIKE
operator comes from SQL, according to https://docs.oasis-open.org/cti/stix/v2.0/cs01/part5-stix-patterning/stix-v2.0-cs01-part5-stix-patterning.html#_Toc496717750
stix-shifter should use the pattern supplied by the user with as little modification as necessary. If the user wants wildcards at the start and end, they can add them.
Example:
Expected behavior
Perform the search the user asked for, without changing its meaning.