gis-9099 add microsoft sentinel to one vendor flow

Author: nazargesyk

uncoder-core/app/translator/platforms/microsoft/const.py

@@ -19,15 +19,18 @@
 
 PLATFORM_DETAILS = {"group_id": "sentinel", "group_name": "Microsoft Sentinel"}
 
+_SENTINEL_KQL_QUERY = "sentinel-kql-query"
+_SENTINEL_KQL_RULE = "sentinel-kql-rule"
+
 MICROSOFT_SENTINEL_QUERY_DETAILS = {
-    "platform_id": "sentinel-kql-query",
+    "platform_id": _SENTINEL_KQL_QUERY,
     "name": "Microsoft Sentinel Query",
     "platform_name": "Query (Kusto)",
     **PLATFORM_DETAILS,
 }
 
 MICROSOFT_SENTINEL_RULE_DETAILS = {
-    "platform_id": "sentinel-kql-rule",
+    "platform_id": _SENTINEL_KQL_RULE,
     "name": "Microsoft Sentinel Rule",
     "platform_name": "Rule (Kusto)",
     "first_choice": 0,
@@ -50,6 +53,8 @@
     "group_id": "microsoft-defender",
 }
 
+MICROSOFT_QUERY_TYPES = {_SENTINEL_KQL_QUERY, _SENTINEL_KQL_RULE}
+
 microsoft_defender_query_details = PlatformDetails(**MICROSOFT_DEFENDER_DETAILS)
 microsoft_sentinel_query_details = PlatformDetails(**MICROSOFT_SENTINEL_QUERY_DETAILS)
 microsoft_sentinel_rule_details = PlatformDetails(**MICROSOFT_SENTINEL_RULE_DETAILS)

uncoder-core/app/translator/translator.py

@@ -1,12 +1,16 @@
 import logging
-from typing import Optional
+from collections import Counter
+from typing import Optional, Union
 
 from app.translator.core.exceptions.core import UnsupportedPlatform
 from app.translator.core.models.query_container import RawQueryContainer, TokenizedQueryContainer
-from app.translator.core.parser import QueryParser
+from app.translator.core.parser import PlatformQueryParser, QueryParser
 from app.translator.core.render import QueryRender
 from app.translator.managers import ParserManager, RenderManager, parser_manager, render_manager
 from app.translator.platforms.elasticsearch.const import ELASTIC_QUERY_TYPES
+from app.translator.platforms.microsoft.const import MICROSOFT_QUERY_TYPES
+from app.translator.platforms.roota.parsers.roota import RootAParser
+from app.translator.platforms.sigma.mapping import sigma_rule_mappings
 from app.translator.tools.decorators import handle_translation_exceptions
 
 
@@ -32,18 +36,36 @@ def __get_render(self, target: str) -> QueryRender:
 
     @staticmethod
     def __is_one_vendor_translation(source: str, target: str) -> bool:
-        vendors_query_types = [ELASTIC_QUERY_TYPES]
+        vendors_query_types = [ELASTIC_QUERY_TYPES, MICROSOFT_QUERY_TYPES]
         for vendor_query_types in vendors_query_types:
             if source in vendor_query_types and target in vendor_query_types:
                 return True
 
         return False
 
-    def parse_raw_query(self, text: str, source: str) -> tuple[QueryParser, RawQueryContainer]:
+    def parse_raw_query(
+        self, text: str, source: str
+    ) -> tuple[Union[PlatformQueryParser, RootAParser], RawQueryContainer]:
         parser = self.__get_parser(source)
         text = parser.remove_comments(text)
         return parser, parser.parse_raw_query(text, language=source)
 
+    def parse_meta_info(self, text: str, source: str) -> Union[dict, RawQueryContainer]:
+        parser, raw_query_container = self.parse_raw_query(text=text, source=source)
+        source_mappings = parser.get_source_mapping_ids_by_logsources(raw_query_container.query)
+        log_sources = {"product": Counter(), "service": Counter(), "category": Counter()}
+        sigma_source_mappings = sigma_rule_mappings.get_source_mappings_by_ids(
+            [source_mapping.source_id for source_mapping in source_mappings], return_default=False
+        )
+        for sigma_source_mapping in sigma_source_mappings:
+            if product := sigma_source_mapping.log_source_signature.log_sources.get("product"):
+                log_sources["product"][product] += 1
+            if service := sigma_source_mapping.log_source_signature.log_sources.get("service"):
+                log_sources["service"][service] += 1
+            if category := sigma_source_mapping.log_source_signature.log_sources.get("category"):
+                log_sources["category"][category] += 1
+        return log_sources, raw_query_container
+
     @handle_translation_exceptions
     def __parse_incoming_data(
         self, text: str, source: str, target: Optional[str] = None