mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-08 20:37:12 +00:00
Fix Parser Test Runner JSON mode, Filter Simulator PQ syntax, dropdown source
- backend/routers/quality.py
* Add GET /api/quality/parsers (lists actual files in /app/parsers)
* Support SDL JSON auto-extract parsers ($=json{parse=json}$)
* Apply parser rewrite blocks with correct $0/$N backref translation
* Accept single JSON / JSON array / NDJSON in test-parser body
* Flatten JSON inside 'message' for Field Population coverage
- backend/routers/ingest.py
* Rewrite simulate-filter PowerQuery to valid SDL syntax
* Correct field name: src.name -> dataSource.name
- frontend/index.html
* Parser dropdown loads from /api/quality/parsers
* Add 'Last 7d' lookback option
* Render JSON-mode test results with badges + payload counter
This commit is contained in:
@@ -92,12 +92,15 @@ async def simulate_filter(rule: FilterRule):
|
||||
|
||||
clauses = []
|
||||
if rule.source:
|
||||
clauses.append(f'src.name = "{rule.source}"')
|
||||
clauses.append(f"dataSource.name=='{rule.source}'")
|
||||
if rule.event_type:
|
||||
clauses.append(f'event.type = "{rule.event_type}"')
|
||||
clauses.append(f"event.type=='{rule.event_type}'")
|
||||
|
||||
filter_expr = " AND ".join(clauses) if clauses else "true"
|
||||
query = f"| filter {filter_expr} | count() as events"
|
||||
if clauses:
|
||||
filter_expr = " and ".join(clauses)
|
||||
query = f"| filter {filter_expr} | group events=count()"
|
||||
else:
|
||||
query = "| group events=count()"
|
||||
|
||||
try:
|
||||
result = await s1_client.run_powerquery(query, from_dt, to_dt)
|
||||
|
||||
Reference in New Issue
Block a user