opencybersecurityalliance / firepit

Firepit - STIX Columnar Storage
Apache License 2.0
15 stars 12 forks source link

STIX MATCHES operator is translated to SQL incorrectly #116

Closed pcoccoli closed 9 months ago

pcoccoli commented 10 months ago

firepit just passes MATCHES through, but I think we need to use MATCH for SQLite3 (https://www.sqlite.org/lang_expr.html) and ~ for PostgreSQL (https://www.postgresql.org/docs/current/functions-matching.html#FUNCTIONS-POSIX-REGEXP)