Codecov Report

Attention: Patch coverage is 94.44444% with 1 lines in your changes are missing coverage. Please review.

Project coverage is 83.75%. Comparing base (fcdd7f0) to head (f5cc6fa).
Report is 12 commits behind head on master.

@@             Coverage Diff             @@
##           master   #11089       +/-   ##
===========================================
+ Coverage   64.19%   83.75%   +19.55%     
===========================================
  Files         847      922       +75     
  Lines      136684   250478   +113794     
===========================================
+ Hits        87750   209785   +122035     
+ Misses      48934    40693     -8241     

Given a rule with reference:url,www.vpngate.net;, I get the following logged:

    "references": [
      "http://www.vpngate.net"
    ],

what are the other possibilities?

I guess I had expected something more like:

"references": [
    {"scheme": "url", "value": "www.vpngate.net"}
]

Information: QA ran without warnings.

Pipeline 20653

Given a rule with reference:url,www.vpngate.net;, I get the following logged:

    "references": [
      "http://www.vpngate.net"
    ],

what are the other possibilities?

I guess I had expected something more like:

"references": [
    {"scheme": "url", "value": "www.vpngate.net"}
]

The reference associated with the signature has already been transformed from the scheme/value layout using reference.config. Thus, reference values available when adding to the alert are of the form { "http://", "www.vpgate.net"} Other possibilities are defined by the reference.config file and how the rules are used.

A more complicated example is a rule with a reference: reference:md5,8ec85e487dff0a868e1eed78e0c43460 This would be transformed into { "http://www.threatexpert.com/report.aspx?md5=", "8ec85e487dff0a868e1eed78e0c43460" } and included in the alert as "references":[ "http://www.threatexpert.com/report.aspx?md5=8ec85e487dff0a868e1eed78e0c43460" ]