Snapshot 95 demo-tenant parsers (incl. stormshield) + un-ignore parsers/

The original upstream gitignores parsers/* on the assumption that each tenant has its own set. This fork commits a working snapshot so the Parser Test Runner and Parser Coverage features are usable out of the box. Stormshield parser exercises the new SDL key=value scanner, pattern references, and JS-style unquoted format keys added to backend/routers/quality.py.
2026-06-11 05:41:19 +00:00 · 2026-05-22 14:11:39 +02:00
parent 1e61fa9814
commit a9dcf48e65
96 changed files with 14742 additions and 5 deletions
@@ -0,0 +1,147 @@
+{
+    "attributes": {
+        "dataSource.name": "Microsoft 365 Collaboration",
+        "dataSource.vendor": "Microsoft",
+        "dataSource.category": "security",
+        "metadata.product.name": "Microsoft 365 SharePoint/OneDrive",
+        "metadata.product.vendor_name": "Microsoft",
+        "metadata.version": "1.0.0"
+    },
+    "formats": [
+        {
+            "format": "$unmapped.{parse=gron}$",
+            "rewrites": [
+                {
+                    "input": "unmapped.TimeStamp",
+                    "output": "timestamp",
+                    "match": ".*",
+                    "replace": "$0"
+                }
+            ]
+        }
+    ],
+    "mappings": {
+        "version": 1,
+        "mappings": [
+            {
+                "predicate": "true",
+                "transformations": [
+                    {
+                        "constant": {
+                            "value": 1,
+                            "field": "activity_id"
+                        }
+                    },
+                    {
+                        "constant": {
+                            "value": "Create",
+                            "field": "activity_name"
+                        }
+                    },
+                    {
+                        "constant": {
+                            "value": 1,
+                            "field": "category_uid"
+                        }
+                    },
+                    {
+                        "constant": {
+                            "value": 1006,
+                            "field": "class_uid"
+                        }
+                    },
+                    {
+                        "constant": {
+                            "value": "File Activity",
+                            "field": "class_name"
+                        }
+                    },
+                    {
+                        "constant": {
+                            "value": "System Activity",
+                            "field": "category_name"
+                        }
+                    },
+                    {
+                        "constant": {
+                            "value": 100601,
+                            "field": "type_uid"
+                        }
+                    },
+                    {
+                        "constant": {
+                            "value": "File Activity: Create",
+                            "field": "type_name"
+                        }
+                    },
+                    {
+                        "copy": {
+                            "from": "unmapped.TimeStamp",
+                            "to": "time"
+                        }
+                    },
+                    {
+                        "cast": {
+                            "field": "time",
+                            "type": "iso8601TimestampToEpochSec"
+                        }
+                    },
+                    {
+                        "rename": {
+                            "from": "unmapped.UserId",
+                            "to": "actor.user.email_addr"
+                        }
+                    },
+                    {
+                        "rename": {
+                            "from": "unmapped.Operation",
+                            "to": "activity_name"
+                        }
+                    },
+                    {
+                        "rename": {
+                            "from": "unmapped.SiteUrl",
+                            "to": "src_endpoint.url.url_string"
+                        }
+                    },
+                    {
+                        "rename": {
+                            "from": "unmapped.ObjectId",
+                            "to": "file.path"
+                        }
+                    },
+                    {
+                        "rename": {
+                            "from": "unmapped.FileName",
+                            "to": "file.name"
+                        }
+                    },
+                    {
+                        "rename": {
+                            "from": "unmapped.TargetUser",
+                            "to": "user.email_addr"
+                        }
+                    },
+                    {
+                        "rename": {
+                            "from": "unmapped.RequestedBy",
+                            "to": "actor.user.name"
+                        }
+                    },
+                    {
+                        "rename": {
+                            "from": "unmapped.Details",
+                            "to": "message"
+                        }
+                    },
+                    {
+                        "constant": {
+                            "value": "Microsoft 365",
+                            "field": "cloud.provider"
+                        }
+                    }
+                ]
+            }
+        ]
+    }
+}