opencybersecurityalliance / kestrel-lang

Kestrel threat hunting language: building reusable, composable, and shareable huntflows across different data sources and threat intel.
Apache License 2.0
300 stars 51 forks source link

Pattern adapters for other patterning languages #294

Open pcoccoli opened 1 year ago

pcoccoli commented 1 year ago

A way to implement #122 could be through "pattern adapters" - these would be modules that allow the user to specify patterns in something other than STIX patterns (or ECGPatterns). Some examples:

subbyte commented 1 year ago

Good idea making the patterning sub-language extensible.

We may want to have an ABC for any adapter to implement two functions: to_stix() and to_firepit().