valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 17:35:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #664 from j91321/es-rule-options

Browse Source 
es-rule backend options for index-patterns and time interval
This commit is contained in:
Thomas Patzke 2020-04-08 22:39:45 +02:00 committed by GitHub
commit 7224af54b2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
tools/sigma/backends/elasticsearch.py
View File

@ -1145,9 +1145,12 @@ class ElasticSearchRuleBackend(ElasticsearchQuerystringBackend):
def generate(self, sigmaparser):
translation = super().generate(sigmaparser)
if translation:
index = sigmaparser.get_logsource().index
if len(index) == 0:
index = ["apm-*-transaction", "auditbeat-*", "endgame-*", "filebeat-*", "packetbeat-*", "winlogbeat-*"]
configs = sigmaparser.parsedyaml
configs.update({"translation": translation})
rule = self.create_rule(configs)
rule = self.create_rule(configs, index)
return rule
def create_threat_description(self, tactics_list, techniques_list):
@ -1195,7 +1198,7 @@ class ElasticSearchRuleBackend(ElasticsearchQuerystringBackend):
elif level == "critical":
return randrange(74,101)
def create_rule(self, configs):
def create_rule(self, configs, index):
tags = configs.get("tags", [])
tactics_list = list()
technics_list = list()
@ -1231,14 +1234,7 @@ class ElasticSearchRuleBackend(ElasticsearchQuerystringBackend):
"filters": [],
"from": "now-360s",
"immutable": False,
"index": [
"apm-*-transaction*",
"auditbeat-*",
"endgame-*",
"filebeat-*",
"packetbeat-*",
"winlogbeat-*"
],
"index": index,
"interval": "5m",
"rule_id": rule_id,
"language": "lucene",