{"action":"created","comment":{"url":"https://api.github.com/repos/IBM/stix-shifter/pulls/comments/233452468","pull_request_review_id":174866712,"id":233452468,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIzMzQ1MjQ2OA==","diff_hunk":"@@ -95,7 +95,24 @@\n     \"key\": \"url.value\"\n   },\n   \"filename\": {\n-    \"key\": \"file.name\"\n+    \"key\": \"file.name\",\n+    \"object\": \"fl\"\n+  },\n+  \"sha256hash\": {\n+    \"key\": \"file.hashes.SHA-256\",\n+    \"object\": \"fl\"\n+  },\n+  \"sha1hash\": {\n+    \"key\": \"file.hashes.SHA-1\",\n+    \"object\": \"fl\"\n+  },\n+  \"md5hash\": {\n+    \"key\": \"file.hashes.MD5\",\n+    \"object\": \"fl\"\n+  },\n+  \"filehash\": {\n+    \"key\": \"file.hashes.UNKNOWN\",","path":"stix_shifter/src/modules/qradar/json/to_stix_map.json","position":21,"original_position":21,"commit_id":"06796ac9cea456b500c35d2070dcd872ab31253d","original_commit_id":"6339f7ae24ab62b94f8bcfb0f8bab4db2c2240a6","user":{"login":"delliott90","id":2227208,"node_id":"MDQ6VXNlcjIyMjcyMDg=","avatar_url":"https://avatars0.githubusercontent.com/u/2227208?v=4","gravatar_id":"","url":"https://api.github.com/users/delliott90","html_url":"https://github.com/delliott90","followers_url":"https://api.github.com/users/delliott90/followers","following_url":"https://api.github.com/users/delliott90/following{/other_user}","gists_url":"https://api.github.com/users/delliott90/gists{/gist_id}","starred_url":"https://api.github.com/users/delliott90/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/delliott90/subscriptions","organizations_url":"https://api.github.com/users/delliott90/orgs","repos_url":"https://api.github.com/users/delliott90/repos","events_url":"https://api.github.com/users/delliott90/events{/privacy}","received_events_url":"https://api.github.com/users/delliott90/received_events","type":"User","site_admin":false},"body":"No, and it should never be stored in the STIX bundle as that either. I only have it there because the generic \"filehash\" column still needs to be captured and parsed into STIX. Basically, this mapping gets overridden when the filehash attribute gets put into STIX.","created_at":"2018-11-14T13:47:23Z","updated_at":"2018-11-14T13:47:23Z","html_url":"https://github.com/IBM/stix-shifter/pull/68#discussion_r233452468","pull_request_url":"https://api.github.com/repos/IBM/stix-shifter/pulls/68","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/IBM/stix-shifter/pulls/comments/233452468"},"html":{"href":"https://github.com/IBM/stix-shifter/pull/68#discussion_r233452468"},"pull_request":{"href":"https://api.github.com/repos/IBM/stix-shifter/pulls/68"}},"in_reply_to_id":233450625},"pull_request":{"url":"https://api.github.com/repos/IBM/stix-shifter/pulls/68","id":230695333,"node_id":"MDExOlB1bGxSZXF1ZXN0MjMwNjk1MzMz","html_url":"https://github.com/IBM/stix-shifter/pull/68","diff_url":"https://github.com/IBM/stix-shifter/pull/68.diff","patch_url":"https://github.com/IBM/stix-shifter/pull/68.patch","issue_url":"https://api.github.com/repos/IBM/stix-shifter/issues/68","number":68,"state":"open","locked":false,"title":"Qradar filehash","user":{"login":"delliott90","id":2227208,"node_id":"MDQ6VXNlcjIyMjcyMDg=","avatar_url":"https://avatars0.githubusercontent.com/u/2227208?v=4","gravatar_id":"","url":"https://api.github.com/users/delliott90","html_url":"https://github.com/delliott90","followers_url":"https://api.github.com/users/delliott90/followers","following_url":"https://api.github.com/users/delliott90/following{/other_user}","gists_url":"https://api.github.com/users/delliott90/gists{/gist_id}","starred_url":"https://api.github.com/users/delliott90/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/delliott90/subscriptions","organizations_url":"https://api.github.com/users/delliott90/orgs","repos_url":"https://api.github.com/users/delliott90/repos","events_url":"https://api.github.com/users/delliott90/events{/privacy}","received_events_url":"https://api.github.com/users/delliott90/received_events","type":"User","site_admin":false},"body":"Adds file hash support to the QRadar module. In cases where QRadar returns an ambiguous hash type, the log source id is examined to attempt to determine the type","created_at":"2018-11-14T03:04:52Z","updated_at":"2018-11-14T13:47:23Z","closed_at":null,"merged_at":null,"merge_commit_sha":"9e6a88620ab19feac247c405f92f6c3cf396b888","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/IBM/stix-shifter/pulls/68/commits","review_comments_url":"https://api.github.com/repos/IBM/stix-shifter/pulls/68/comments","review_comment_url":"https://api.github.com/repos/IBM/stix-shifter/pulls/comments{/number}","comments_url":"https://api.github.com/repos/IBM/stix-shifter/issues/68/comments","statuses_url":"https://api.github.com/repos/IBM/stix-shifter/statuses/06796ac9cea456b500c35d2070dcd872ab31253d","head":{"label":"IBM:qradar_filehash","ref":"qradar_filehash","sha":"06796ac9cea456b500c35d2070dcd872ab31253d","user":{"login":"IBM","id":1459110,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE0NTkxMTA=","avatar_url":"https://avatars0.githubusercontent.com/u/1459110?v=4","gravatar_id":"","url":"https://api.github.com/users/IBM","html_url":"https://github.com/IBM","followers_url":"https://api.github.com/users/IBM/followers","following_url":"https://api.github.com/users/IBM/following{/other_user}","gists_url":"https://api.github.com/users/IBM/gists{/gist_id}","starred_url":"https://api.github.com/users/IBM/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/IBM/subscriptions","organizations_url":"https://api.github.com/users/IBM/orgs","repos_url":"https://api.github.com/users/IBM/repos","events_url":"https://api.github.com/users/IBM/events{/privacy}","received_events_url":"https://api.github.com/users/IBM/received_events","type":"Organization","site_admin":false},"repo":{"id":133072277,"node_id":"MDEwOlJlcG9zaXRvcnkxMzMwNzIyNzc=","name":"stix-shifter","full_name":"IBM/stix-shifter","private":false,"owner":{"login":"IBM","id":1459110,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE0NTkxMTA=","avatar_url":"https://avatars0.githubusercontent.com/u/1459110?v=4","gravatar_id":"","url":"https://api.github.com/users/IBM","html_url":"https://github.com/IBM","followers_url":"https://api.github.com/users/IBM/followers","following_url":"https://api.github.com/users/IBM/following{/other_user}","gists_url":"https://api.github.com/users/IBM/gists{/gist_id}","starred_url":"https://api.github.com/users/IBM/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/IBM/subscriptions","organizations_url":"https://api.github.com/users/IBM/orgs","repos_url":"https://api.github.com/users/IBM/repos","events_url":"https://api.github.com/users/IBM/events{/privacy}","received_events_url":"https://api.github.com/users/IBM/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/IBM/stix-shifter","description":"This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.","fork":false,"url":"https://api.github.com/repos/IBM/stix-shifter","forks_url":"https://api.github.com/repos/IBM/stix-shifter/forks","keys_url":"https://api.github.com/repos/IBM/stix-shifter/keys{/key_id}","collaborators_url":"https://api.github.com/repos/IBM/stix-shifter/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/IBM/stix-shifter/teams","hooks_url":"https://api.github.com/repos/IBM/stix-shifter/hooks","issue_events_url":"https://api.github.com/repos/IBM/stix-shifter/issues/events{/number}","events_url":"https://api.github.com/repos/IBM/stix-shifter/events","assignees_url":"https://api.github.com/repos/IBM/stix-shifter/assignees{/user}","branches_url":"https://api.github.com/repos/IBM/stix-shifter/branches{/branch}","tags_url":"https://api.github.com/repos/IBM/stix-shifter/tags","blobs_url":"https://api.github.com/repos/IBM/stix-shifter/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/IBM/stix-shifter/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/IBM/stix-shifter/git/refs{/sha}","trees_url":"https://api.github.com/repos/IBM/stix-shifter/git/trees{/sha}","statuses_url":"https://api.github.com/repos/IBM/stix-shifter/statuses/{sha}","languages_url":"https://api.github.com/repos/IBM/stix-shifter/languages","stargazers_url":"https://api.github.com/repos/IBM/stix-shifter/stargazers","contributors_url":"https://api.github.com/repos/IBM/stix-shifter/contributors","subscribers_url":"https://api.github.com/repos/IBM/stix-shifter/subscribers","subscription_url":"https://api.github.com/repos/IBM/stix-shifter/subscription","commits_url":"https://api.github.com/repos/IBM/stix-shifter/commits{/sha}","git_commits_url":"https://api.github.com/repos/IBM/stix-shifter/git/commits{/sha}","comments_url":"https://api.github.com/repos/IBM/stix-shifter/comments{/number}","issue_comment_url":"https://api.github.com/repos/IBM/stix-shifter/issues/comments{/number}","contents_url":"https://api.github.com/repos/IBM/stix-shifter/contents/{+path}","compare_url":"https://api.github.com/repos/IBM/stix-shifter/compare/{base}...{head}","merges_url":"https://api.github.com/repos/IBM/stix-shifter/merges","archive_url":"https://api.github.com/repos/IBM/stix-shifter/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/IBM/stix-shifter/downloads","issues_url":"https://api.github.com/repos/IBM/stix-shifter/issues{/number}","pulls_url":"https://api.github.com/repos/IBM/stix-shifter/pulls{/number}","milestones_url":"https://api.github.com/repos/IBM/stix-shifter/milestones{/number}","notifications_url":"https://api.github.com/repos/IBM/stix-shifter/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/IBM/stix-shifter/labels{/name}","releases_url":"https://api.github.com/repos/IBM/stix-shifter/releases{/id}","deployments_url":"https://api.github.com/repos/IBM/stix-shifter/deployments","created_at":"2018-05-11T18:01:01Z","updated_at":"2018-11-07T19:41:48Z","pushed_at":"2018-11-14T13:44:28Z","git_url":"git://github.com/IBM/stix-shifter.git","ssh_url":"git@github.com:IBM/stix-shifter.git","clone_url":"https://github.com/IBM/stix-shifter.git","svn_url":"https://github.com/IBM/stix-shifter","homepage":null,"size":295,"stargazers_count":15,"watchers_count":15,"language":"Python","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":10,"mirror_url":null,"archived":false,"open_issues_count":8,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":10,"open_issues":8,"watchers":15,"default_branch":"master"}},"base":{"label":"IBM:master","ref":"master","sha":"754b81737af752b53fddf10a306b24caa365686c","user":{"login":"IBM","id":1459110,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE0NTkxMTA=","avatar_url":"https://avatars0.githubusercontent.com/u/1459110?v=4","gravatar_id":"","url":"https://api.github.com/users/IBM","html_url":"https://github.com/IBM","followers_url":"https://api.github.com/users/IBM/followers","following_url":"https://api.github.com/users/IBM/following{/other_user}","gists_url":"https://api.github.com/users/IBM/gists{/gist_id}","starred_url":"https://api.github.com/users/IBM/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/IBM/subscriptions","organizations_url":"https://api.github.com/users/IBM/orgs","repos_url":"https://api.github.com/users/IBM/repos","events_url":"https://api.github.com/users/IBM/events{/privacy}","received_events_url":"https://api.github.com/users/IBM/received_events","type":"Organization","site_admin":false},"repo":{"id":133072277,"node_id":"MDEwOlJlcG9zaXRvcnkxMzMwNzIyNzc=","name":"stix-shifter","full_name":"IBM/stix-shifter","private":false,"owner":{"login":"IBM","id":1459110,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE0NTkxMTA=","avatar_url":"https://avatars0.githubusercontent.com/u/1459110?v=4","gravatar_id":"","url":"https://api.github.com/users/IBM","html_url":"https://github.com/IBM","followers_url":"https://api.github.com/users/IBM/followers","following_url":"https://api.github.com/users/IBM/following{/other_user}","gists_url":"https://api.github.com/users/IBM/gists{/gist_id}","starred_url":"https://api.github.com/users/IBM/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/IBM/subscriptions","organizations_url":"https://api.github.com/users/IBM/orgs","repos_url":"https://api.github.com/users/IBM/repos","events_url":"https://api.github.com/users/IBM/events{/privacy}","received_events_url":"https://api.github.com/users/IBM/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/IBM/stix-shifter","description":"This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.","fork":false,"url":"https://api.github.com/repos/IBM/stix-shifter","forks_url":"https://api.github.com/repos/IBM/stix-shifter/forks","keys_url":"https://api.github.com/repos/IBM/stix-shifter/keys{/key_id}","collaborators_url":"https://api.github.com/repos/IBM/stix-shifter/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/IBM/stix-shifter/teams","hooks_url":"https://api.github.com/repos/IBM/stix-shifter/hooks","issue_events_url":"https://api.github.com/repos/IBM/stix-shifter/issues/events{/number}","events_url":"https://api.github.com/repos/IBM/stix-shifter/events","assignees_url":"https://api.github.com/repos/IBM/stix-shifter/assignees{/user}","branches_url":"https://api.github.com/repos/IBM/stix-shifter/branches{/branch}","tags_url":"https://api.github.com/repos/IBM/stix-shifter/tags","blobs_url":"https://api.github.com/repos/IBM/stix-shifter/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/IBM/stix-shifter/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/IBM/stix-shifter/git/refs{/sha}","trees_url":"https://api.github.com/repos/IBM/stix-shifter/git/trees{/sha}","statuses_url":"https://api.github.com/repos/IBM/stix-shifter/statuses/{sha}","languages_url":"https://api.github.com/repos/IBM/stix-shifter/languages","stargazers_url":"https://api.github.com/repos/IBM/stix-shifter/stargazers","contributors_url":"https://api.github.com/repos/IBM/stix-shifter/contributors","subscribers_url":"https://api.github.com/repos/IBM/stix-shifter/subscribers","subscription_url":"https://api.github.com/repos/IBM/stix-shifter/subscription","commits_url":"https://api.github.com/repos/IBM/stix-shifter/commits{/sha}","git_commits_url":"https://api.github.com/repos/IBM/stix-shifter/git/commits{/sha}","comments_url":"https://api.github.com/repos/IBM/stix-shifter/comments{/number}","issue_comment_url":"https://api.github.com/repos/IBM/stix-shifter/issues/comments{/number}","contents_url":"https://api.github.com/repos/IBM/stix-shifter/contents/{+path}","compare_url":"https://api.github.com/repos/IBM/stix-shifter/compare/{base}...{head}","merges_url":"https://api.github.com/repos/IBM/stix-shifter/merges","archive_url":"https://api.github.com/repos/IBM/stix-shifter/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/IBM/stix-shifter/downloads","issues_url":"https://api.github.com/repos/IBM/stix-shifter/issues{/number}","pulls_url":"https://api.github.com/repos/IBM/stix-shifter/pulls{/number}","milestones_url":"https://api.github.com/repos/IBM/stix-shifter/milestones{/number}","notifications_url":"https://api.github.com/repos/IBM/stix-shifter/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/IBM/stix-shifter/labels{/name}","releases_url":"https://api.github.com/repos/IBM/stix-shifter/releases{/id}","deployments_url":"https://api.github.com/repos/IBM/stix-shifter/deployments","created_at":"2018-05-11T18:01:01Z","updated_at":"2018-11-07T19:41:48Z","pushed_at":"2018-11-14T13:44:28Z","git_url":"git://github.com/IBM/stix-shifter.git","ssh_url":"git@github.com:IBM/stix-shifter.git","clone_url":"https://github.com/IBM/stix-shifter.git","svn_url":"https://github.com/IBM/stix-shifter","homepage":null,"size":295,"stargazers_count":15,"watchers_count":15,"language":"Python","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":10,"mirror_url":null,"archived":false,"open_issues_count":8,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":10,"open_issues":8,"watchers":15,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/IBM/stix-shifter/pulls/68"},"html":{"href":"https://github.com/IBM/stix-shifter/pull/68"},"issue":{"href":"https://api.github.com/repos/IBM/stix-shifter/issues/68"},"comments":{"href":"https://api.github.com/repos/IBM/stix-shifter/issues/68/comments"},"review_comments":{"href":"https://api.github.com/repos/IBM/stix-shifter/pulls/68/comments"},"review_comment":{"href":"https://api.github.com/repos/IBM/stix-shifter/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/IBM/stix-shifter/pulls/68/commits"},"statuses":{"href":"https://api.github.com/repos/IBM/stix-shifter/statuses/06796ac9cea456b500c35d2070dcd872ab31253d"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"delliott90"}}