metron-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From justinleet <...@git.apache.org>
Subject [GitHub] incubator-metron issue #438: METRON-686 Record Rule Set that Fired During Th...
Date Thu, 09 Feb 2017 20:42:25 GMT
Github user justinleet commented on the issue:

    https://github.com/apache/incubator-metron/pull/438
  
    Seems like THREAT_TRIAGE_REMOVE just behaves really badly
    
    ```
    [Stellar]>>> conf := THREAT_TRIAGE_ADD(conf, [triage])
    [Stellar]>>> conf := THREAT_TRIAGE_REMOVE(conf, 'Abnormal DNS Port')
    [!] Unable to execute: java.lang.String cannot be cast to java.util.List
    org.apache.metron.common.dsl.ParseException: Unable to execute: java.lang.String cannot
be cast to java.util.List
    	at org.apache.metron.common.stellar.StellarCompiler.getResult(StellarCompiler.java:409)
    	at org.apache.metron.common.stellar.BaseStellarProcessor.parse(BaseStellarProcessor.java:127)
    	at org.apache.metron.common.stellar.shell.StellarExecutor.execute(StellarExecutor.java:275)
    	at org.apache.metron.common.stellar.shell.StellarShell.executeStellar(StellarShell.java:373)
    	at org.apache.metron.common.stellar.shell.StellarShell.handleStellar(StellarShell.java:276)
    	at org.apache.metron.common.stellar.shell.StellarShell.execute(StellarShell.java:412)
    	at org.jboss.aesh.console.AeshProcess.run(AeshProcess.java:53)
    	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    	at java.lang.Thread.run(Thread.java:745)
    Caused by: java.lang.ClassCastException: java.lang.String cannot be cast to java.util.List
    	at org.apache.metron.management.ThreatTriageFunctions$RemoveStellarTransformation.apply(ThreatTriageFunctions.java:232)
    	at org.apache.metron.common.stellar.StellarCompiler.exitTransformationFunc(StellarCompiler.java:267)
    	at org.apache.metron.common.stellar.generated.StellarParser$TransformationFuncContext.exitRule(StellarParser.java:1689)
    	at org.antlr.v4.runtime.Parser.triggerExitRuleEvent(Parser.java:422)
    	at org.antlr.v4.runtime.Parser.exitRule(Parser.java:632)
    	at org.apache.metron.common.stellar.generated.StellarParser.functions(StellarParser.java:1712)
    	at org.apache.metron.common.stellar.generated.StellarParser.arithmetic_operands(StellarParser.java:1846)
    	at org.apache.metron.common.stellar.generated.StellarParser.arithmetic_expr_mul(StellarParser.java:1609)
    	at org.apache.metron.common.stellar.generated.StellarParser.arithmetic_expr(StellarParser.java:1469)
    	at org.apache.metron.common.stellar.generated.StellarParser.transformation_expr(StellarParser.java:308)
    	at org.apache.metron.common.stellar.generated.StellarParser.transformation(StellarParser.java:149)
    	at org.apache.metron.common.stellar.BaseStellarProcessor.parse(BaseStellarProcessor.java:126)
    	... 8 more
    [Stellar]>>> conf
    [Stellar]>>> conf
    [Stellar]>>> conf := THREAT_TRIAGE_REMOVE(conf, ['Abnormal DNS Port'])
    [Stellar]>>> conf
    {
      "enrichment" : {
        "fieldMap" : { },
        "fieldToTypeMap" : { },
        "config" : { }
      },
      "threatIntel" : {
        "fieldMap" : { },
        "fieldToTypeMap" : { },
        "config" : { },
        "triageConfig" : {
          "riskLevelRules" : [ ],
          "aggregator" : "MAX",
          "aggregationConfig" : { }
        }
      },
      "configuration" : { }
    }
    ```
    
    I'd have to check if the same thing happens on master.


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---

Mime
View raw message