Skip to content

Commit

Permalink
Allow generating Elastalert rules with the http_post alert type witho…
Browse files Browse the repository at this point in the history
…ut specifying a URL at generation time
  • Loading branch information
christophetd committed Apr 3, 2019
1 parent 6cc1770 commit d32e5c1
Showing 1 changed file with 11 additions and 10 deletions.
21 changes: 11 additions & 10 deletions tools/sigma/backends/elasticsearch.py
Original file line number Diff line number Diff line change
Expand Up @@ -671,19 +671,20 @@ def generate(self, sigmaparser):
rule_object['smtp_auth_file'] = self.smtp_auth_file
if 'http_post' in alert_methods:
if self.http_post_url is None:
print('Warning: the Elastalert HTTP POST method is selected but no URL has been provided. This alert method will be ignored', file=sys.stderr)
print('Warning: the Elastalert HTTP POST method is selected but no URL has been provided.', file=sys.stderr)
else:
rule_object['alert'].append('post')
rule_object['http_post_url'] = self.http_post_url
if self.http_post_include_rule_metadata:
rule_object['http_post_static_payload'] = {
'sigma_rule_metadata': {
'title': title,
'description': description,
'level': level,
'tags': rule_tag
}

rule_object['alert'].append('post')
if self.http_post_include_rule_metadata:
rule_object['http_post_static_payload'] = {
'sigma_rule_metadata': {
'title': title,
'description': description,
'level': level,
'tags': rule_tag
}
}
#If alert is not define put debug as default
if len(rule_object['alert']) == 0:
rule_object['alert'].append('debug')
Expand Down

0 comments on commit d32e5c1

Please sign in to comment.