Failed to use "translate" from CLI when value includes backslashes (QRadar) about stix-shifter

[delliott90]

This may be fixed, will need to investigate.

[mdazam1942]

@barvhaim I think you need to escape both the backslashes to get 'event\\example' in the query. -

[(x-ibm-ariel:event_name = 'event\\\\example')]

[barvhaim]

it works now with \\ as-is, can close the issue,
translate qradar query {} "[(windows-registry-key:key = 'HKLM\\SYSTEM'" {}

FROM events WHERE ObjectName = 'HKLM\\SYSTEM' limit 10000 last 5 minutes