Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Backport 2.9] Fix keywords bug incorrectly adding field value (#964) #970

Merged
merged 1 commit into from
Apr 5, 2024
Merged

[Backport 2.9] Fix keywords bug incorrectly adding field value (#964) #970

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 16 additions & 8 deletions src/main/java/org/opensearch/securityanalytics/rules/backend/OSQueryBackend.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -329,21 +329,35 @@ public Object convertConditionFieldEqValQueryExpr(ConditionFieldEqualsValueExpre
return null;
}*/

/**
* Method used when structure of Sigma Rule does not have a field associated with the condition item and the value
* is a SigmaString type
* Ex:
* condition: selection_1
* selection1:
* - keyword1
*/
@Override
public Object convertConditionValStr(ConditionValueExpression condition) throws SigmaValueError {
String field = getFinalValueField();
ruleQueryFields.put(field, Map.of("type", "text", "analyzer", "rule_analyzer"));
SigmaString value = (SigmaString) condition.getValue();
boolean containsWildcard = value.containsWildcard();
return String.format(Locale.getDefault(), (containsWildcard? this.unboundWildcardExpression: this.unboundValueStrExpression),
this.convertValueStr((SigmaString) condition.getValue()));
}

/**
* Method used when structure of Sigma Rule does not have a field associated with the condition item and the value
* is a SigmaNumber type
*/
@Override
public Object convertConditionValNum(ConditionValueExpression condition) {
return String.format(Locale.getDefault(), this.unboundValueNumExpression, condition.getValue().toString());
}

/**
* Method used when structure of Sigma Rule does not have a field associated with the condition item and the value
* is a SigmaRegularExpression type
*/
@Override
public Object convertConditionValRe(ConditionValueExpression condition) {
return String.format(Locale.getDefault(), this.unboundReExpression, convertValueRe((SigmaRegularExpression) condition.getValue()));
Expand Down Expand Up @@ -448,12 +462,6 @@ private String getFinalField(String field) {
return this.getMappedField(field);
}

private String getFinalValueField() {
String field = "_" + valExpCount;
valExpCount++;
return field;
}

public static class AggregationQueries implements Writeable, ToXContentObject {
private static final String AGG_QUERY = "aggQuery";
private static final String BUCKET_TRIGGER_QUERY = "bucketTriggerQuery";
Expand Down
Loading