Snapshot 95 demo-tenant parsers (incl. stormshield) + un-ignore parsers/

The original upstream gitignores parsers/* on the assumption that each tenant has its own set. This fork commits a working snapshot so the Parser Test Runner and Parser Coverage features are usable out of the box. Stormshield parser exercises the new SDL key=value scanner, pattern references, and JS-style unquoted format keys added to backend/routers/quality.py.
2026-06-10 21:31:19 +00:00 · 2026-05-22 14:11:39 +02:00
parent 1e61fa9814
commit a9dcf48e65
96 changed files with 14742 additions and 5 deletions
@@ -0,0 +1,75 @@
+{
+  "attributes": {
+    "dataSource.vendor": "GitHub",
+    "dataSource.name": "GitHub Audit",
+    "dataSource.category": "security",
+    "dataSource.technology": "source_control"
+  },
+  
+  "formats": [
+    {
+      "id": "github_audit_json",
+      "format": "$unmapped.{parse=gron}$",
+      "attributes": {
+        "class_uid": 8001,
+        "class_name": "DevOps Activity",
+        "category_uid": 8,
+        "category_name": "System Activity",
+        "type_uid": 800101,
+        "activity_id": 1,
+        "activity_name": "Repository Activity",
+        "severity_id": 1
+      },
+      "rewrites": [
+        {
+          "input": "timestamp",
+          "output": "time",
+          "match": ".*",
+          "replace": "$0"
+        },
+        {
+          "input": "actor",
+          "output": "user.name",
+          "match": ".*",
+          "replace": "$0"
+        },
+        {
+          "input": "source_ip",
+          "output": "src_endpoint.ip",
+          "match": ".*",
+          "replace": "$0"
+        },
+        {
+          "input": "org",
+          "output": "metadata.tenant_uid",
+          "match": ".*",
+          "replace": "$0"
+        },
+        {
+          "input": "repository",
+          "output": "resource.name",
+          "match": ".*",
+          "replace": "$0"
+        },
+        {
+          "input": "action",
+          "output": "activity_name",
+          "match": ".*",
+          "replace": "$0"
+        },
+        {
+          "input": "outcome",
+          "output": "status",
+          "match": ".*",
+          "replace": "$0"
+        },
+        {
+          "input": "description",
+          "output": "message",
+          "match": ".*",
+          "replace": "$0"
+        }
+      ]
+    }
+  ]
+}