diff --git a/tools/sigma/backends/stix.py b/tools/sigma/backends/stix.py index 9f1cfb489c5..82e7b3fd5c1 100644 --- a/tools/sigma/backends/stix.py +++ b/tools/sigma/backends/stix.py @@ -15,6 +15,7 @@ class STIXBackend(SingleTextQueryBackend): valueExpression = "\'%s\'" mapExpression = "%s = %s" mapListsSpecialHandling = True + sigmaSTIXObjectName = "x-sigma" def cleanKey(self, key): if key is None: @@ -50,7 +51,7 @@ def generateMapItemTypedNode(self, key, value): def generateMapItemNode(self, node): key, value = node if ":" not in key: - raise TypeError("Backend does not support mapping for key " + str(key)) + key = "%s:%s" % (self.sigmaSTIXObjectName, str(key).lower()) if self.mapListsSpecialHandling == False and type(value) in (str, int, list) or self.mapListsSpecialHandling == True and type(value) in (str, int): if type(value) == str and "*" in value: value = value.replace("*", "%")