v2.3.27

firepit/__init__.py

@@ -2,7 +2,7 @@
 
 __author__ = """IBM Security"""
 __email__ = 'pcoccoli@us.ibm.com'
-__version__ = '2.3.26'
+__version__ = '2.3.27'
 
 
 import re

firepit/aio/ingest.py

@@ -86,7 +86,7 @@ def _get_mapping(mapping: dict, col: str):
         cmap = tmp
     if cmap is not None:
         if isinstance(cmap, dict):
-            if 'key' in cmap:
+            if 'key' in cmap and isinstance(cmap['key'], str):
                 # there could me more than 1 mapping target
                 cmap = [cmap]
             else:
@@ -437,7 +437,7 @@ def translate(
         if (txf_name == 'ToLowercaseArray' and
             txf_col.endswith('network-traffic:protocols')):
             # Need to properly sort them
-            df[txf_col] = df[txf_col].apply(_to_protocols)
+            df[txf_col] = df[txf_col].dropna().apply(_to_protocols)
         else:
             df[txf_col] = df[txf_col].dropna().apply(txf.transform)
 

setup.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2.3.26
+current_version = 2.3.27
 commit = True
 tag = True
 

setup.py

@@ -32,15 +32,14 @@
 setup(
     author="IBM Security",
     author_email='pcoccoli@us.ibm.com',
-    python_requires='>=3.7',
+    python_requires='>=3.8',
     classifiers=[
         'Development Status :: 4 - Beta',
         'Topic :: Security',
         'Intended Audience :: Developers',
         'License :: OSI Approved :: Apache Software License',
         'Natural Language :: English',
         'Programming Language :: Python :: 3',
-        'Programming Language :: Python :: 3.7',
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
@@ -65,6 +64,6 @@
     test_suite='tests',
     tests_require=test_requirements,
     url='https://github.com/opencybersecurityalliance/firepit',
-    version='2.3.26',
+    version='2.3.27',
     zip_safe=False,
 )

tests/test_asyncingest.py

@@ -450,6 +450,98 @@ def test_unmapped_col():
     df = translate(stix_map, transformers, events, data_source)
 
 
+def test_translate_no_protocol():
+    # Example STIX mapping
+    stix_map = {
+        "CreatedAt": {
+            "key": "first_observed"
+        },
+        "Service": {
+            "Action": {
+                "NetworkConnectionAction": {
+                    "Protocol": [
+                        {
+                            "key": "network-traffic.protocols",
+                            "object": "nt",
+                            "transformer": "ToLowercaseArray"
+                        }
+                    ]
+                }
+            },
+            "Count": {
+                "key": "x-ibm-finding.event_count",
+                "object": "finding"
+            }
+        }
+    }
+    transformers = {
+        'ToLowercaseArray': ToLowercaseArray
+    }
+
+    # Fake up some data
+    events = [
+        {
+            "CreatedAt": "2023-06-08T08:21:04.979Z",
+            "Service": {
+                "Action": {
+                    "ActionType": "AWS_API_CALL",
+                    "AwsApiCallAction": {
+                        "Api": "ListObjects"
+                    }
+                },
+                "Count": 9
+            }
+        },
+        {
+            "CreatedAt": "2023-05-01T13:56:28.723Z",
+            "Service": {
+                "Action": {
+                    "ActionType": "NETWORK_CONNECTION",
+                    "NetworkConnectionAction": {
+                        "Protocol": "TCP"
+                    }
+                },
+                "Count": 7
+            }
+        }
+    ]
+    df = translate(stix_map, transformers, events, data_source)
+
+
+def test_translate_regkey():
+    # Example STIX mapping, based on azure_sentinel
+    stix_map = {
+        "eventDateTime": [
+            {
+                "key": "first_observed"
+            }
+        ],
+        "event_count": {
+            "key": "number_observed",
+            "transformer": "ToInteger"
+        },
+        "registryKeyStates": {
+            "key": {
+                "key": "windows-registry-key.key",
+                "object": "registry"
+            },
+        }
+    }
+    transformers = {
+        'ToInteger': lambda x: int(x),
+        'ToLowercaseArray': ToLowercaseArray
+    }
+
+    # Fake up some data
+    events = [
+        {
+            "eventDateTime": "2023-08-07T22:00:22.052Z",
+            "registryKeyStates": [],
+        }
+    ]
+    df = translate(stix_map, transformers, events, data_source)
+
+
 @pytest.mark.asyncio
 async def test_ingest(tmpdir):
     df = pd.DataFrame(