{"action":"created","comment":{"url":"https://api.github.com/repos/vidkun/splunk/pulls/comments/33170734","id":33170734,"diff_hunk":"@@ -42,41 +42,18 @@\n \tputs e.message\n end\n \n-\tquery = \"WITH vuln_tags AS (SELECT vulnerability_id, array_to_string(array_agg(category_name ORDER BY category_name ASC), ',') AS tags FROM dim_vulnerability_category GROUP BY vulnerability_id), vulnerability_cves AS (SELECT vulnerability_id, array_to_string(array_agg(reference), ',') AS cves FROM dim_vulnerability_reference WHERE source = 'CVE' GROUP BY vulnerability_id), vulnerability_bugs AS (SELECT vulnerability_id, array_to_string(array_agg(reference), ',') AS bugs FROM dim_vulnerability_reference WHERE source = 'BID' GROUP BY vulnerability_id), vuln_skill AS (SELECT vulnerability_id, array_to_string(array_agg(skill_level), ',') AS skill FROM dim_vulnerability_exploit GROUP BY vulnerability_id) SELECT fa.scan_started AS start_time, fa.scan_finished AS end_time, da.ip_address AS dest_ip, da.host_name AS dest_nt_host, da.mac_address AS dest_mac, dos.description AS os, dv.nexpose_id AS signature_id, dv.title AS signature, dv.severity AS severity, dv.exploits AS exploits, dv.malware_kits AS malware_kits, dve.skill AS skill_mv, round(dv.cvss_score::numeric, 2) AS cvss_score, cvss_vector, vtags.tags AS category_mv, vcves.cves AS cve_mv, vbugs.bugs AS bugtraq_mv FROM fact_asset_vulnerability_finding favf JOIN dim_asset da USING (asset_id) JOIN fact_asset fa USING (asset_id) JOIN dim_operating_system dos USING (operating_system_id) JOIN dim_vulnerability dv USING (vulnerability_id) JOIN vuln_tags vtags USING (vulnerability_id) LEFT OUTER JOIN vulnerability_cves vcves USING (vulnerability_id) LEFT OUTER JOIN vulnerability_bugs vbugs USING (vulnerability_id) JOIN vuln_skill dve USING (vulnerability_id) JOIN dim_site_asset dsa USING (asset_id) JOIN dim_site ds USING (site_id) WHERE ds.site_id IN (#{site_list.join(', ')}) ORDER BY da.ip_address ASC, dv.title ASC\"\n+\tquery = \"WITH vuln_tags AS (SELECT vulnerability_id, array_to_string(array_agg(category_name ORDER BY category_name ASC), ', ') AS tags FROM dim_vulnerability_category GROUP BY vulnerability_id), vulnerability_cves AS (SELECT vulnerability_id, array_to_string(array_agg(reference), ', ') AS cves FROM dim_vulnerability_reference WHERE source = 'CVE' GROUP BY vulnerability_id), vulnerability_bugs AS (SELECT vulnerability_id, array_to_string(array_agg(reference), ', ') AS bugs FROM dim_vulnerability_reference WHERE source = 'BID' GROUP BY vulnerability_id), vuln_skill AS (SELECT vulnerability_id, array_to_string(array_agg(skill_level), ', ') AS skill FROM dim_vulnerability_exploit GROUP BY vulnerability_id) SELECT fa.scan_started AS start_time, fa.scan_finished AS end_time, da.ip_address AS dest_ip, da.host_name AS dest_nt_host, da.mac_address AS dest_mac, dos.description AS os, dv.nexpose_id AS signature_id, dv.title AS signature, dv.severity AS severity, dv.exploits AS exploits, dv.malware_kits AS malware_kits, dve.skill AS skill_mv, round(dv.cvss_score::numeric, 2) AS cvss_score, cvss_vector, vtags.tags AS category_mv, vcves.cves AS cve_mv, vbugs.bugs AS bugtraq_mv FROM fact_asset_vulnerability_finding favf JOIN dim_asset da USING (asset_id) JOIN fact_asset fa USING (asset_id) JOIN dim_operating_system dos USING (operating_system_id) JOIN dim_vulnerability dv USING (vulnerability_id) JOIN vuln_tags vtags USING (vulnerability_id) LEFT OUTER JOIN vulnerability_cves vcves USING (vulnerability_id) LEFT OUTER JOIN vulnerability_bugs vbugs USING (vulnerability_id) JOIN vuln_skill dve USING (vulnerability_id) JOIN dim_site_asset dsa USING (asset_id) JOIN dim_site ds USING (site_id) WHERE ds.site_id IN (#{site_list.join(', ')}) ORDER BY da.ip_address ASC, dv.title ASC\"\n \treport_config = Nexpose::AdhocReportConfig.new(nil, 'sql')\n-\treport_config.add_filter('version', '1.2.1')\n+\treport_config.add_filter('version', '2.0.0')","path":"TA-nexpose/bin/nexpose2splunk.rb","position":14,"original_position":14,"commit_id":"b4f4d6771389a5a0449095a2a80489cdd0bde83f","original_commit_id":"b4f4d6771389a5a0449095a2a80489cdd0bde83f","user":{"login":"houndci","id":6697940,"avatar_url":"https://avatars.githubusercontent.com/u/6697940?v=3","gravatar_id":"","url":"https://api.github.com/users/houndci","html_url":"https://github.com/houndci","followers_url":"https://api.github.com/users/houndci/followers","following_url":"https://api.github.com/users/houndci/following{/other_user}","gists_url":"https://api.github.com/users/houndci/gists{/gist_id}","starred_url":"https://api.github.com/users/houndci/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/houndci/subscriptions","organizations_url":"https://api.github.com/users/houndci/orgs","repos_url":"https://api.github.com/users/houndci/repos","events_url":"https://api.github.com/users/houndci/events{/privacy}","received_events_url":"https://api.github.com/users/houndci/received_events","type":"User","site_admin":false},"body":"Inconsistent indentation detected.<br>Prefer double-quoted strings unless you need single quotes to avoid extra backslashes for escaping.<br>Tab detected.","created_at":"2015-06-24T17:08:43Z","updated_at":"2015-06-24T17:08:43Z","html_url":"https://github.com/vidkun/splunk/pull/1#discussion_r33170734","pull_request_url":"https://api.github.com/repos/vidkun/splunk/pulls/1","_links":{"self":{"href":"https://api.github.com/repos/vidkun/splunk/pulls/comments/33170734"},"html":{"href":"https://github.com/vidkun/splunk/pull/1#discussion_r33170734"},"pull_request":{"href":"https://api.github.com/repos/vidkun/splunk/pulls/1"}}},"pull_request":{"url":"https://api.github.com/repos/vidkun/splunk/pulls/1","id":38464704,"html_url":"https://github.com/vidkun/splunk/pull/1","diff_url":"https://github.com/vidkun/splunk/pull/1.diff","patch_url":"https://github.com/vidkun/splunk/pull/1.patch","issue_url":"https://api.github.com/repos/vidkun/splunk/issues/1","number":1,"state":"open","locked":false,"title":"Refactor","user":{"login":"vidkun","id":627820,"avatar_url":"https://avatars.githubusercontent.com/u/627820?v=3","gravatar_id":"","url":"https://api.github.com/users/vidkun","html_url":"https://github.com/vidkun","followers_url":"https://api.github.com/users/vidkun/followers","following_url":"https://api.github.com/users/vidkun/following{/other_user}","gists_url":"https://api.github.com/users/vidkun/gists{/gist_id}","starred_url":"https://api.github.com/users/vidkun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vidkun/subscriptions","organizations_url":"https://api.github.com/users/vidkun/orgs","repos_url":"https://api.github.com/users/vidkun/repos","events_url":"https://api.github.com/users/vidkun/events{/privacy}","received_events_url":"https://api.github.com/users/vidkun/received_events","type":"User","site_admin":false},"body":"The original SQL query was returning multi-value fields as 'value1,value2,...' and then we had to iterate over each row in the returned csv to manually split those fields and re-join them with a space after each comma (such as: 'value1, value2, ...'). This introduced unnecessary work and processing.\r\n\r\nI updated the SQL query to return the multi-value fields directly in the desired format with the space ('value1, value2, ...') and removed the processing to split and re-join each one. Also swapped out the references when building the event to call the original field names from the query results.\r\n\r\nData model version has also been bumped to the latest version: 2.0.0.","created_at":"2015-06-24T17:08:38Z","updated_at":"2015-06-24T17:08:43Z","closed_at":null,"merged_at":null,"merge_commit_sha":"a7363c91938c9a97f6312bb455ad8126d7c5eb4c","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/vidkun/splunk/pulls/1/commits","review_comments_url":"https://api.github.com/repos/vidkun/splunk/pulls/1/comments","review_comment_url":"https://api.github.com/repos/vidkun/splunk/pulls/comments{/number}","comments_url":"https://api.github.com/repos/vidkun/splunk/issues/1/comments","statuses_url":"https://api.github.com/repos/vidkun/splunk/statuses/b4f4d6771389a5a0449095a2a80489cdd0bde83f","head":{"label":"vidkun:refactor","ref":"refactor","sha":"b4f4d6771389a5a0449095a2a80489cdd0bde83f","user":{"login":"vidkun","id":627820,"avatar_url":"https://avatars.githubusercontent.com/u/627820?v=3","gravatar_id":"","url":"https://api.github.com/users/vidkun","html_url":"https://github.com/vidkun","followers_url":"https://api.github.com/users/vidkun/followers","following_url":"https://api.github.com/users/vidkun/following{/other_user}","gists_url":"https://api.github.com/users/vidkun/gists{/gist_id}","starred_url":"https://api.github.com/users/vidkun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vidkun/subscriptions","organizations_url":"https://api.github.com/users/vidkun/orgs","repos_url":"https://api.github.com/users/vidkun/repos","events_url":"https://api.github.com/users/vidkun/events{/privacy}","received_events_url":"https://api.github.com/users/vidkun/received_events","type":"User","site_admin":false},"repo":{"id":22104105,"name":"splunk","full_name":"vidkun/splunk","owner":{"login":"vidkun","id":627820,"avatar_url":"https://avatars.githubusercontent.com/u/627820?v=3","gravatar_id":"","url":"https://api.github.com/users/vidkun","html_url":"https://github.com/vidkun","followers_url":"https://api.github.com/users/vidkun/followers","following_url":"https://api.github.com/users/vidkun/following{/other_user}","gists_url":"https://api.github.com/users/vidkun/gists{/gist_id}","starred_url":"https://api.github.com/users/vidkun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vidkun/subscriptions","organizations_url":"https://api.github.com/users/vidkun/orgs","repos_url":"https://api.github.com/users/vidkun/repos","events_url":"https://api.github.com/users/vidkun/events{/privacy}","received_events_url":"https://api.github.com/users/vidkun/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/vidkun/splunk","description":"A collection of splunk-related works","fork":false,"url":"https://api.github.com/repos/vidkun/splunk","forks_url":"https://api.github.com/repos/vidkun/splunk/forks","keys_url":"https://api.github.com/repos/vidkun/splunk/keys{/key_id}","collaborators_url":"https://api.github.com/repos/vidkun/splunk/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/vidkun/splunk/teams","hooks_url":"https://api.github.com/repos/vidkun/splunk/hooks","issue_events_url":"https://api.github.com/repos/vidkun/splunk/issues/events{/number}","events_url":"https://api.github.com/repos/vidkun/splunk/events","assignees_url":"https://api.github.com/repos/vidkun/splunk/assignees{/user}","branches_url":"https://api.github.com/repos/vidkun/splunk/branches{/branch}","tags_url":"https://api.github.com/repos/vidkun/splunk/tags","blobs_url":"https://api.github.com/repos/vidkun/splunk/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/vidkun/splunk/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/vidkun/splunk/git/refs{/sha}","trees_url":"https://api.github.com/repos/vidkun/splunk/git/trees{/sha}","statuses_url":"https://api.github.com/repos/vidkun/splunk/statuses/{sha}","languages_url":"https://api.github.com/repos/vidkun/splunk/languages","stargazers_url":"https://api.github.com/repos/vidkun/splunk/stargazers","contributors_url":"https://api.github.com/repos/vidkun/splunk/contributors","subscribers_url":"https://api.github.com/repos/vidkun/splunk/subscribers","subscription_url":"https://api.github.com/repos/vidkun/splunk/subscription","commits_url":"https://api.github.com/repos/vidkun/splunk/commits{/sha}","git_commits_url":"https://api.github.com/repos/vidkun/splunk/git/commits{/sha}","comments_url":"https://api.github.com/repos/vidkun/splunk/comments{/number}","issue_comment_url":"https://api.github.com/repos/vidkun/splunk/issues/comments{/number}","contents_url":"https://api.github.com/repos/vidkun/splunk/contents/{+path}","compare_url":"https://api.github.com/repos/vidkun/splunk/compare/{base}...{head}","merges_url":"https://api.github.com/repos/vidkun/splunk/merges","archive_url":"https://api.github.com/repos/vidkun/splunk/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/vidkun/splunk/downloads","issues_url":"https://api.github.com/repos/vidkun/splunk/issues{/number}","pulls_url":"https://api.github.com/repos/vidkun/splunk/pulls{/number}","milestones_url":"https://api.github.com/repos/vidkun/splunk/milestones{/number}","notifications_url":"https://api.github.com/repos/vidkun/splunk/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/vidkun/splunk/labels{/name}","releases_url":"https://api.github.com/repos/vidkun/splunk/releases{/id}","created_at":"2014-07-22T13:04:15Z","updated_at":"2014-07-22T17:09:00Z","pushed_at":"2015-06-24T17:08:38Z","git_url":"git://github.com/vidkun/splunk.git","ssh_url":"git@github.com:vidkun/splunk.git","clone_url":"https://github.com/vidkun/splunk.git","svn_url":"https://github.com/vidkun/splunk","homepage":null,"size":144,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":0,"default_branch":"master"}},"base":{"label":"vidkun:master","ref":"master","sha":"06d5c69b23f0669cc570a9124059f5ac92b51932","user":{"login":"vidkun","id":627820,"avatar_url":"https://avatars.githubusercontent.com/u/627820?v=3","gravatar_id":"","url":"https://api.github.com/users/vidkun","html_url":"https://github.com/vidkun","followers_url":"https://api.github.com/users/vidkun/followers","following_url":"https://api.github.com/users/vidkun/following{/other_user}","gists_url":"https://api.github.com/users/vidkun/gists{/gist_id}","starred_url":"https://api.github.com/users/vidkun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vidkun/subscriptions","organizations_url":"https://api.github.com/users/vidkun/orgs","repos_url":"https://api.github.com/users/vidkun/repos","events_url":"https://api.github.com/users/vidkun/events{/privacy}","received_events_url":"https://api.github.com/users/vidkun/received_events","type":"User","site_admin":false},"repo":{"id":22104105,"name":"splunk","full_name":"vidkun/splunk","owner":{"login":"vidkun","id":627820,"avatar_url":"https://avatars.githubusercontent.com/u/627820?v=3","gravatar_id":"","url":"https://api.github.com/users/vidkun","html_url":"https://github.com/vidkun","followers_url":"https://api.github.com/users/vidkun/followers","following_url":"https://api.github.com/users/vidkun/following{/other_user}","gists_url":"https://api.github.com/users/vidkun/gists{/gist_id}","starred_url":"https://api.github.com/users/vidkun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vidkun/subscriptions","organizations_url":"https://api.github.com/users/vidkun/orgs","repos_url":"https://api.github.com/users/vidkun/repos","events_url":"https://api.github.com/users/vidkun/events{/privacy}","received_events_url":"https://api.github.com/users/vidkun/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/vidkun/splunk","description":"A collection of splunk-related works","fork":false,"url":"https://api.github.com/repos/vidkun/splunk","forks_url":"https://api.github.com/repos/vidkun/splunk/forks","keys_url":"https://api.github.com/repos/vidkun/splunk/keys{/key_id}","collaborators_url":"https://api.github.com/repos/vidkun/splunk/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/vidkun/splunk/teams","hooks_url":"https://api.github.com/repos/vidkun/splunk/hooks","issue_events_url":"https://api.github.com/repos/vidkun/splunk/issues/events{/number}","events_url":"https://api.github.com/repos/vidkun/splunk/events","assignees_url":"https://api.github.com/repos/vidkun/splunk/assignees{/user}","branches_url":"https://api.github.com/repos/vidkun/splunk/branches{/branch}","tags_url":"https://api.github.com/repos/vidkun/splunk/tags","blobs_url":"https://api.github.com/repos/vidkun/splunk/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/vidkun/splunk/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/vidkun/splunk/git/refs{/sha}","trees_url":"https://api.github.com/repos/vidkun/splunk/git/trees{/sha}","statuses_url":"https://api.github.com/repos/vidkun/splunk/statuses/{sha}","languages_url":"https://api.github.com/repos/vidkun/splunk/languages","stargazers_url":"https://api.github.com/repos/vidkun/splunk/stargazers","contributors_url":"https://api.github.com/repos/vidkun/splunk/contributors","subscribers_url":"https://api.github.com/repos/vidkun/splunk/subscribers","subscription_url":"https://api.github.com/repos/vidkun/splunk/subscription","commits_url":"https://api.github.com/repos/vidkun/splunk/commits{/sha}","git_commits_url":"https://api.github.com/repos/vidkun/splunk/git/commits{/sha}","comments_url":"https://api.github.com/repos/vidkun/splunk/comments{/number}","issue_comment_url":"https://api.github.com/repos/vidkun/splunk/issues/comments{/number}","contents_url":"https://api.github.com/repos/vidkun/splunk/contents/{+path}","compare_url":"https://api.github.com/repos/vidkun/splunk/compare/{base}...{head}","merges_url":"https://api.github.com/repos/vidkun/splunk/merges","archive_url":"https://api.github.com/repos/vidkun/splunk/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/vidkun/splunk/downloads","issues_url":"https://api.github.com/repos/vidkun/splunk/issues{/number}","pulls_url":"https://api.github.com/repos/vidkun/splunk/pulls{/number}","milestones_url":"https://api.github.com/repos/vidkun/splunk/milestones{/number}","notifications_url":"https://api.github.com/repos/vidkun/splunk/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/vidkun/splunk/labels{/name}","releases_url":"https://api.github.com/repos/vidkun/splunk/releases{/id}","created_at":"2014-07-22T13:04:15Z","updated_at":"2014-07-22T17:09:00Z","pushed_at":"2015-06-24T17:08:38Z","git_url":"git://github.com/vidkun/splunk.git","ssh_url":"git@github.com:vidkun/splunk.git","clone_url":"https://github.com/vidkun/splunk.git","svn_url":"https://github.com/vidkun/splunk","homepage":null,"size":144,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":0,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/vidkun/splunk/pulls/1"},"html":{"href":"https://github.com/vidkun/splunk/pull/1"},"issue":{"href":"https://api.github.com/repos/vidkun/splunk/issues/1"},"comments":{"href":"https://api.github.com/repos/vidkun/splunk/issues/1/comments"},"review_comments":{"href":"https://api.github.com/repos/vidkun/splunk/pulls/1/comments"},"review_comment":{"href":"https://api.github.com/repos/vidkun/splunk/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/vidkun/splunk/pulls/1/commits"},"statuses":{"href":"https://api.github.com/repos/vidkun/splunk/statuses/b4f4d6771389a5a0449095a2a80489cdd0bde83f"}}}}