opencybersecurityalliance/stix-shifter

LIKE operator has wildcards added to it in some connector modules

Opened this issue · 0 comments

Describe the bug
Some connectors (like qradar) are adding wildcards to the start and end of the user's value when translating the LIKE operator. The LIKE operator comes from SQL, according to https://docs.oasis-open.org/cti/stix/v2.0/cs01/part5-stix-patterning/stix-v2.0-cs01-part5-stix-patterning.html#_Toc496717750
stix-shifter should use the pattern supplied by the user with as little modification as necessary. If the user wants wildcards at the start and end, they can add them.

Example:

Expected behavior
Perform the search the user asked for, without changing its meaning.