From a6d3dcf3988464992748e54d2e512d9aa34ea5bc Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Thu, 8 Oct 2020 13:36:47 +0000 Subject: [PATCH] More fixes for rule field --- salt/elasticsearch/files/ingest/strelka.file | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/salt/elasticsearch/files/ingest/strelka.file b/salt/elasticsearch/files/ingest/strelka.file index fdddd5d39..43ad6c283 100644 --- a/salt/elasticsearch/files/ingest/strelka.file +++ b/salt/elasticsearch/files/ingest/strelka.file @@ -39,8 +39,8 @@ { "convert" : { "if": "ctx.rule?.score != null", "field" : "rule.score","type": "integer"}}, { "set": { "if": "ctx.rule?.score != null && ctx.rule?.score >= 0 && ctx.rule?.score <= 49", "field": "event.severity", "value": 1, "override": true } }, { "set": { "if": "ctx.rule?.score != null && ctx.rule?.score >= 50 && ctx.rule?.score <=69", "field": "event.severity", "value": 2, "override": true } }, - { "set": { "if": "ctx.rule != null && ctx.rule?.score >= 70 && ctx.rule?.score <=89", "field": "event.severity", "value": 3, "override": true } }, - { "set": { "if": "ctx.rule != null && ctx.rule?.score >= 90", "field": "event.severity", "value": 4, "override": true } }, + { "set": { "if": "ctx.rule?.score != null && ctx.rule?.score >= 70 && ctx.rule?.score <=89", "field": "event.severity", "value": 3, "override": true } }, + { "set": { "if": "ctx.rule?.score != null && ctx.rule?.score >= 90", "field": "event.severity", "value": 4, "override": true } }, { "set": { "field": "observer.name", "value": "{{agent.name}}" }}, { "remove": { "field": ["host", "path", "message", "scan.exiftool.keys", "scan.yara.meta"], "ignore_missing": true } }, { "pipeline": { "name": "common" } }