Skip to content

Commit

Permalink
use Sigma tags, not detection tags
Browse files Browse the repository at this point in the history
  • Loading branch information
jertel committed Aug 27, 2024
1 parent 9f9b623 commit d7079b7
Show file tree
Hide file tree
Showing 3 changed files with 83 additions and 10 deletions.
3 changes: 2 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,5 @@ __pycache__
.coverage
*.pyc

__debug_bin*
__debug_bin*
.venv
15 changes: 11 additions & 4 deletions server/modules/elastalert/elastalert.go
Original file line number Diff line number Diff line change
Expand Up @@ -1582,9 +1582,9 @@ func (e *ElastAlertEngine) MergeAuxiliaryData(detect *model.Detection) error {
}

func (e *ElastAlertEngine) getCustomAlerters(tags []string) ([]string, string) {
alertersKey := ""
paramsKey := ""
if e.moduleConfig != nil {
alertersKey := ""
paramsKey := ""
for _, tag := range tags {
if strings.HasPrefix(tag, "so.alerters.") {
alertersKey = strings.TrimPrefix(tag, "so.alerters.")
Expand Down Expand Up @@ -1804,7 +1804,14 @@ func (e *ElastAlertEngine) wrapRule(det *model.Detection, rule string) (string,
model.SeverityCritical: 5,
}

alerters, params := e.getCustomAlerters(det.Tags)
var sigmaTags []string
sigmaRule, err := ParseElastAlertRule([]byte(det.Content))
if err != nil {
log.WithError(err).WithField("detectionPublicId", det.PublicID).Error("failed to parse Sigma rule content")
} else {
sigmaTags = sigmaRule.Tags
}
alerters, params := e.getCustomAlerters(sigmaTags)
if len(alerters) == 0 {
alerters, params = e.getAdditionalAlerters(severities[det.Severity])
}
Expand All @@ -1831,7 +1838,7 @@ func (e *ElastAlertEngine) wrapRule(det *model.Detection, rule string) (string,
Filter: []map[string]interface{}{{"eql": rule}},
}

if slices.Contains(det.Tags, "so.notification") {
if slices.Contains(sigmaTags, "so.notification") {
// This is a detection for sending notifications only, do not add a new alert to Security Onion.
wrapper.Alert = nil
}
Expand Down
75 changes: 70 additions & 5 deletions server/modules/elastalert/elastalert_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -492,7 +492,24 @@ func TestSigmaToElastAlertCustomNotificationLicensed(t *testing.T) {

det := &model.Detection{
PublicID: "00000000-0000-0000-0000-000000000000",
Content: "totally good sigma",
Content: `
title: Test Detection
id: 00000000-0000-0000-0000-000000000000
logsource:
product: linux
service: auth
detection:
selection:
event.outcome: failure
process.name: sshd
tags|contains: so-grid-node
filter:
system.auth.ssh.method: '*'
condition: selection and not filter
tags:
- so.alerters.MyAlerters
- so.params.MyParams
`,
Title: "Test Detection",
Tags: []string{"so.alerters.MyAlerters", "so.params.MyParams"},
Severity: model.SeverityHigh,
Expand Down Expand Up @@ -568,9 +585,25 @@ func TestSigmaToElastAlertCustomNotificationUnlicensed(t *testing.T) {

det := &model.Detection{
PublicID: "00000000-0000-0000-0000-000000000000",
Content: "totally good sigma",
Content: `
title: Test Detection
id: 00000000-0000-0000-0000-000000000000
logsource:
product: linux
service: auth
detection:
selection:
event.outcome: failure
process.name: sshd
tags|contains: so-grid-node
filter:
system.auth.ssh.method: '*'
condition: selection and not filter
tags:
- so.alerters.MyAlerters
- so.params.MyParams
`,
Title: "Test Detection",
Tags: []string{"so.alerters.MyAlerters", "so.params.MyParams"},
Severity: model.SeverityHigh,
}

Expand Down Expand Up @@ -633,7 +666,23 @@ func TestSigmaToElastAlertNotificationOnlyLicensed(t *testing.T) {

det := &model.Detection{
PublicID: "00000000-0000-0000-0000-000000000000",
Content: "totally good sigma",
Content: `
title: Test Detection
id: 00000000-0000-0000-0000-000000000000
logsource:
product: linux
service: auth
detection:
selection:
event.outcome: failure
process.name: sshd
tags|contains: so-grid-node
filter:
system.auth.ssh.method: '*'
condition: selection and not filter
tags:
- so.notification
`,
Title: "Test Detection",
Tags: []string{"so.notification"},
Severity: model.SeverityHigh,
Expand Down Expand Up @@ -700,7 +749,23 @@ func TestSigmaToElastAlertNotificationOnlyUnlicensed(t *testing.T) {

det := &model.Detection{
PublicID: "00000000-0000-0000-0000-000000000000",
Content: "totally good sigma",
Content: `
title: Test Detection
id: 00000000-0000-0000-0000-000000000000
logsource:
product: linux
service: auth
detection:
selection:
event.outcome: failure
process.name: sshd
tags|contains: so-grid-node
filter:
system.auth.ssh.method: '*'
condition: selection and not filter
tags:
- so.notification
`,
Title: "Test Detection",
Tags: []string{"so.notification"},
Severity: model.SeverityHigh,
Expand Down

0 comments on commit d7079b7

Please sign in to comment.