valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

sigmac: Kibana curl output generates one index pattern line per pattern

Browse Source
This commit is contained in:
Thomas Patzke 2018-03-16 23:53:12 +01:00
parent 578118315c
commit f6858c436a
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tools/sigma/backends.py
View File

@ -315,7 +315,7 @@ class KibanaBackend(ElasticsearchQuerystringBackend, MultiRuleOutputMixin):
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
self.kibanaconf = list()
self.indexsearch = list()
self.indexsearch = set()
self.output_type = self.options.setdefault("output", "import")
self.es = self.options.setdefault("es", "localhost:9200")
self.index = self.options.setdefault("index", ".kibana")
@ -352,7 +352,7 @@ class KibanaBackend(ElasticsearchQuerystringBackend, MultiRuleOutputMixin):
else:
title = self.prefix + sigmaparser.parsedyaml["title"]
self.indexsearch.append(
self.indexsearch.add(
"export {indexvar}=$(curl -s '{es}/{index}/_search?q=index-pattern.title:{indexpattern}' | jq -r '.hits.hits[0]._id | ltrimstr(\"index-pattern:\")')".format(
es=self.es,
index=self.index,