google / google/timesketch

Refactor the validation_regex feature for context links

Open
#2,452 0 comments 0 reactions 1 assignee Claimed by @jkppr View on GitHub
Frontend
Dominant language
Python
Stars
3.4k
Forks
666
Avg merge
7d 22m
Merged PRs (30d)
5

Description

Related to #2439 .

With the current approach for configuring context links, it can end up in a very nasty long regex if we want to support multiple fields.

Example with virustotal:
```
match_fields: ['host', 'url', 'domain', 'md5_hash', 'md5', 'sha1_hash', 'sha1', 'sha256_hash', 'sha256', 'hash', 'ipv4', 'ip', 'ip_address', 'dest_ip', 'source_ip']
validation_regex: '/(\b25[0-5]|\b2[0-4][0-9]|\b[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}|(^(?!-)[A-Za-z0-9-]+([\-\.]{1}[a-z0-9]+)*\.[A-Za-z]{2,6}$)|(^[0-9a-f]{64}$)|(^[0-9a-f]{40}$)|(^[0-9a-f]{32}$)|((([A-Za-z]{3,9}:(?:\/\/)?)(?:[\-;:&=\+\$,\w]+@)?[A-Za-z0-9\.\-]+|(?:www\.|[\-;:&=\+\$,\w]+@)[A-Za-z0-9\.\-]+)((?:\/[\+~%\/\.\w\-_]*)?\??(?:[\-\+=&;%@\.\w_]*)#?(?:[\.\!\/\\\w]*))?)|((?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9][a-z0-9-]{0,61}[a-z0-9])/i'
```

Some ideas on how to potentially fix this:

- Allow for defining regex types in the config that can be re-used per item. E.g. define `sha256 = ^[0-9a-f]{64}$` and reuse that as keyword in the `validation_regex`.
- Allow to reference regex defined by the intelligence feature for `validation_regex`.
- Allow to reference the same external service multiple times for different fields.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.