diff --git a/server/modules/elastalert/elastalert_test.go b/server/modules/elastalert/elastalert_test.go index 930704aab..7d41d6477 100644 --- a/server/modules/elastalert/elastalert_test.go +++ b/server/modules/elastalert/elastalert_test.go @@ -244,8 +244,8 @@ func TestSigmaToElastAlertSunnyDay(t *testing.T) { expected := `play_title: Test Detection play_id: 00000000-0000-0000-0000-000000000000 -event.module: elastalert -event.dataset: elastalert.alert +event.module: sigma +event.dataset: sigma.alert event.severity: 4 rule.category: "" sigma_level: high @@ -544,7 +544,7 @@ func TestSyncElastAlert(t *testing.T) { // sigmaToElastAlert m.EXPECT().ExecCommand(gomock.Any()).Return([]byte("[sigma rule]"), 0, time.Duration(0), nil) // WriteFile when enabling - m.EXPECT().WriteFile(SimpleRuleSID + ".yml", []byte("play_title: TEST\nplay_id: " + SimpleRuleSID + "\nevent.module: elastalert\nevent.dataset: elastalert.alert\nevent.severity: 3\nrule.category: \"\"\nsigma_level: medium\nalert:\n - modules.so.playbook-es.PlaybookESAlerter\nindex: .ds-logs-*\nname: TEST - " + SimpleRuleSID + "\ntype: any\nfilter:\n - eql: '[sigma rule]'\nplay_url: play_url\nkibana_pivot: kibana_pivot\nsoc_pivot: soc_pivot\n"), fs.FileMode(0644)).Return(nil) + m.EXPECT().WriteFile(SimpleRuleSID + ".yml", []byte("play_title: TEST\nplay_id: " + SimpleRuleSID + "\nevent.module: sigma\nevent.dataset: sigma.alert\nevent.severity: 3\nrule.category: \"\"\nsigma_level: medium\nalert:\n - modules.so.playbook-es.PlaybookESAlerter\nindex: .ds-logs-*\nname: TEST - " + SimpleRuleSID + "\ntype: any\nfilter:\n - eql: '[sigma rule]'\nplay_url: play_url\nkibana_pivot: kibana_pivot\nsoc_pivot: soc_pivot\n"), fs.FileMode(0644)).Return(nil) }, }, { @@ -610,7 +610,7 @@ func TestSyncElastAlert(t *testing.T) { // sigmaToElastAlert m.EXPECT().ExecCommand(gomock.Any()).Return([]byte("[sigma rule]"), 0, time.Duration(0), nil) // WriteFile when enabling - m.EXPECT().WriteFile(SimpleRuleSID + ".yml", []byte("play_title: TEST\nplay_id: " + SimpleRuleSID + "\nevent.module: elastalert\nevent.dataset: elastalert.alert\nevent.severity: 3\nrule.category: \"\"\nsigma_level: medium\nalert:\n - modules.so.playbook-es.PlaybookESAlerter\nindex: .ds-logs-*\nname: TEST - " + SimpleRuleSID + "\ntype: any\nfilter:\n - eql: ([sigma rule]) and TRUE\nplay_url: play_url\nkibana_pivot: kibana_pivot\nsoc_pivot: soc_pivot\n"), fs.FileMode(0644)).Return(nil) + m.EXPECT().WriteFile(SimpleRuleSID + ".yml", []byte("play_title: TEST\nplay_id: " + SimpleRuleSID + "\nevent.module: sigma\nevent.dataset: sigma.alert\nevent.severity: 3\nrule.category: \"\"\nsigma_level: medium\nalert:\n - modules.so.playbook-es.PlaybookESAlerter\nindex: .ds-logs-*\nname: TEST - " + SimpleRuleSID + "\ntype: any\nfilter:\n - eql: ([sigma rule]) and TRUE\nplay_url: play_url\nkibana_pivot: kibana_pivot\nsoc_pivot: soc_pivot\n"), fs.FileMode(0644)).Return(nil) }, }, }