valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Use config dateField in xpack watcher to determine

Browse Source 
datefield name as in elasticsearch dsl backend
This commit is contained in:
herrBez 2019-09-10 15:59:49 +02:00
parent 038900e2fe
commit 8f612f743c
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
tools/sigma/backends/elasticsearch.py
View File

@ -452,6 +452,7 @@ class XPackWatcherBackend(ElasticsearchQuerystringBackend, MultiRuleOutputMixin)
tags = sigmaparser.parsedyaml.setdefault("tags", "")
# Get time frame if exists
interval = sigmaparser.parsedyaml["detection"].setdefault("timeframe", "30m")
dateField = self.sigmaconfig.config.get("dateField", "date")
# creating condition
indices = sigmaparser.get_logsource().index
@ -673,7 +674,7 @@ class XPackWatcherBackend(ElasticsearchQuerystringBackend, MultiRuleOutputMixin)
"filter":
{
"range":{
"timestamp":{
dateField:{
"gte":"now-%s/m"%self.filter_range #filter only for the last x minutes events
}
}