valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 17:58:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1622 from frack113/elastalert_issue

Browse Source 
Change getRuleName() to get 'id-title' instead of ('id' or 'title')
This commit is contained in:
Florian Roth 2021-07-04 14:19:02 +02:00 committed by GitHub
commit 3d47fec2d8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
tools/sigma/backends/elasticsearch.py
View File

@ -1171,7 +1171,7 @@ class ElastalertBackend(DeepFieldMappingMixin, MultiRuleOutputMixin):
for parsed in sigmaparser.condparsed:
#Static data
rule_object = {
"name": rulename + "_" + str(rule_number),
"name": rulename,
"description": description,
"index": index,
"priority": self.convertLevel(level),

11
tools/sigma/backends/mixins.py
View File

@ -68,9 +68,16 @@ class MultiRuleOutputMixin:
"""
try:
rulename = sigmaparser.parsedyaml["id"]
yaml_id = sigmaparser.parsedyaml["id"]
except KeyError:
rulename = sigmaparser.parsedyaml["title"].replace(" ", "-").replace("(", "").replace(")", "")
yaml_id = "00000000-0000-0000-0000-000000000000"
try:
yaml_title = sigmaparser.parsedyaml["title"]
except KeyError:
yaml_title = "No Title"
yaml_title = yaml_title.replace(" ", "-").replace("(", "").replace(")", "")
rulename = "%s-%s" % (yaml_id, yaml_title)
if rulename in self.rulenames: # add counter if name collides
cnt = 2
while "%s-%d" % (rulename, cnt) in self.rulenames: