def pattern_mapping(self, threat_type, indicator_threat_value, indicator_threat_type):
        """To map threat value with pattern for microsoft sentinel indicator data."""
        pattern = ""
        if threat_type == "url":
            indicator_threat_value_url = (
                indicator_threat_value.replace("\\n", "").replace("\\r", "").replace("\\u", "").replace("\\", "")
            )
            pattern = "[url:value = '{}']".format(indicator_threat_value_url)
        elif threat_type == "domain-name":
            pattern = "[domain-name:value = '{}']".format(indicator_threat_value)
        elif threat_type == "file":
            if indicator_threat_type == "SHA256":
                pattern = "[file:hashes.'SHA-256' = '{}']".format(indicator_threat_value)
            elif indicator_threat_type == "MD5":
                pattern = "[file:hashes.'MD5' = '{}']".format(indicator_threat_value)
        return pattern
To map threat value with pattern for microsoft sentinel indicator data.
Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/CofenseBasedIndicatorCreator/cofense_to_sentinel_mapping.py