From 875360f373a713d1cb7d03f8f3ff833233cdb202 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Stra=C3=9Fegger?= Date: Mon, 20 Jul 2020 14:32:30 +0200 Subject: [PATCH] fixed wrong function call for elastalert aggregation. fixes #940 --- tools/sigma/backends/elasticsearch.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/sigma/backends/elasticsearch.py b/tools/sigma/backends/elasticsearch.py index 8dc193d7..28645991 100644 --- a/tools/sigma/backends/elasticsearch.py +++ b/tools/sigma/backends/elasticsearch.py @@ -1037,7 +1037,7 @@ class ElastalertBackend(DeepFieldMappingMixin, MultiRuleOutputMixin): if parsed.parsedAgg: if parsed.parsedAgg.aggfunc == sigma.parser.condition.SigmaAggregationParser.AGGFUNC_COUNT or parsed.parsedAgg.aggfunc == sigma.parser.condition.SigmaAggregationParser.AGGFUNC_MIN or parsed.parsedAgg.aggfunc == sigma.parser.condition.SigmaAggregationParser.AGGFUNC_MAX or parsed.parsedAgg.aggfunc == sigma.parser.condition.SigmaAggregationParser.AGGFUNC_AVG or parsed.parsedAgg.aggfunc == sigma.parser.condition.SigmaAggregationParser.AGGFUNC_SUM: if parsed.parsedAgg.groupfield is not None: - rule_object['query_key'] = self.fieldNameMapping(parsed.parsedAgg.groupfield, '*', True) + rule_object['query_key'] = self.fieldNameMapping(parsed.parsedAgg.groupfield, '*') rule_object['type'] = "metric_aggregation" rule_object['buffer_time'] = interval rule_object['doc_type'] = "doc"