Skip to content

Commit

Permalink
fix type error
Browse files Browse the repository at this point in the history
  • Loading branch information
kevinlog committed Jun 24, 2021
1 parent 761ff48 commit aaf285d
Showing 1 changed file with 53 additions and 40 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -369,61 +369,74 @@ export const getPrepopulatedEndpointException = ({
const filePath = file?.path ?? '';
const sha256Hash = file?.hash?.sha256 ?? '';
const isLinux = host?.os?.name === 'Linux';
const filePathDefault = isLinux ? 'file.path' : 'file.path.caseless';

const codeSignatureFields = [
{
field: 'file.Ext.code_signature',
type: 'nested',
entries: [
const entriesToAdd = () => {
if (isLinux) {
return addIdToEntries([
{
field: 'subject_name',
field: 'file.path',
operator: 'included',
type: 'match',
value: codeSignature != null ? codeSignature.subjectName : '',
value: filePath ?? '',
},
{
field: 'trusted',
field: 'file.hash.sha256',
operator: 'included',
type: 'match',
value: codeSignature != null ? codeSignature.trusted : '',
value: sha256Hash ?? '',
},
],
},
];

const commonFields = [
{
field: filePathDefault,
operator: 'included',
type: 'match',
value: filePath ?? '',
},
{
field: 'file.hash.sha256',
operator: 'included',
type: 'match',
value: sha256Hash ?? '',
},
{
field: 'event.code',
operator: 'included',
type: 'match',
value: eventCode ?? '',
},
];

const entriesToAdd = () => {
if (isLinux) {
return commonFields;
{
field: 'event.code',
operator: 'included',
type: 'match',
value: eventCode ?? '',
},
]);
} else {
return [...codeSignatureFields, ...commonFields];
return addIdToEntries([
{
field: 'file.Ext.code_signature',
type: 'nested',
entries: [
{
field: 'subject_name',
operator: 'included',
type: 'match',
value: codeSignature != null ? codeSignature.subjectName : '',
},
{
field: 'trusted',
operator: 'included',
type: 'match',
value: codeSignature != null ? codeSignature.trusted : '',
},
],
},
{
field: 'file.path.caseless',
operator: 'included',
type: 'match',
value: filePath ?? '',
},
{
field: 'file.hash.sha256',
operator: 'included',
type: 'match',
value: sha256Hash ?? '',
},
{
field: 'event.code',
operator: 'included',
type: 'match',
value: eventCode ?? '',
},
]);
}
};

return {
...getNewExceptionItem({ listId, namespaceType: listNamespace, ruleName }),
entries: addIdToEntries(entriesToAdd()),
entries: entriesToAdd(),
};
};

Expand Down

0 comments on commit aaf285d

Please sign in to comment.