Multiple values of `artifcat:payload_bin` translation for QRadar about stix-shifter

[mdazam1942]

@barvhaim test it out with our current changes and let us know if that fixes the issue.

[mdazam1942]

@barvhaim can you confirm 2nd part of the issue-

Moreover, you also cannot use any other field in the WHERE clause when using TEXT SEARCH, for example:
[ipv4-addr:value = '127.0.0.1' AND artifact:payload_bin LIKE 'x'] will cause an invalid AQL

I tried running this below aql query and its not complaining-

SELECT * FROM events WHERE TEXT SEARCH 'x' AND (sourceip = '127.0.0.1' OR destinationip = '127.0.0.1' OR identityip = '127.0.0.1') limit 10000 last 5 minutes

[mdazam1942]

ohk so I figured TEXT SEARCH operator needs to be the first otherwise aql throws error. this query fails-
SELECT * FROM events WHERE (sourceip = '127.0.0.1' OR destinationip = '127.0.0.1' OR identityip = '127.0.0.1') AND TEXT SEARCH 'x' limit 10000 last 5 minutes

so if you keep artifact:payload_bin the last object than it will translate into a valid aql query-

[ipv4-addr:value = '127.0.0.1' AND artifact:payload_bin LIKE 'x']

[mdazam1942]

I'm confused. I tried running the aql query which I thought is valid directly in QRadar console it works but api call fails.