diff --git a/stix_shifter_modules/crowdstrike_alerts/stix_translation/query_constructor.py b/stix_shifter_modules/crowdstrike_alerts/stix_translation/query_constructor.py index 1650c3022..ca9202cb7 100644 --- a/stix_shifter_modules/crowdstrike_alerts/stix_translation/query_constructor.py +++ b/stix_shifter_modules/crowdstrike_alerts/stix_translation/query_constructor.py @@ -50,7 +50,9 @@ def _parse_mapped_fields(self, value, comparator, mapped_fields_array) -> str: comparison_strings = [] if isinstance(value, str): - value = [value] + value = [value] + if isinstance(value,int): + value = [value] for val in value: for mapped_field in mapped_fields_array: comparison_strings.append(f"{mapped_field}{comparator} '{val}'") diff --git a/stix_shifter_modules/trellix_endpoint_security_hx/test/stix_translation/test_trellix_endpoint_security_hx_stix_to_query.py b/stix_shifter_modules/trellix_endpoint_security_hx/test/stix_translation/test_trellix_endpoint_security_hx_stix_to_query.py index fa87d123b..7617093af 100644 --- a/stix_shifter_modules/trellix_endpoint_security_hx/test/stix_translation/test_trellix_endpoint_security_hx_stix_to_query.py +++ b/stix_shifter_modules/trellix_endpoint_security_hx/test/stix_translation/test_trellix_endpoint_security_hx_stix_to_query.py @@ -362,7 +362,7 @@ def test_multiple_observation_with_single_qualifier_with_precedence_bracket(self self._test_query_assertions(query, queries) def test_future_timestamp_qualifier(self): - stix_pattern = "[network-traffic:src_port < 53]START t'2024-09-19T11:00:00.000Z' " \ + stix_pattern = "[network-traffic:src_port < 53]START t'2027-09-19T11:00:00.000Z' " \ "STOP t'2024-02-07T11:00:00.003Z'" result = translation.translate('trellix_endpoint_security_hx', 'query', '{}', stix_pattern, {"host_sets": "host_set1"})