Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for threat match rule type #694

Closed
wants to merge 2 commits into from
Closed

Add support for threat match rule type #694

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bde3385
add threat_match rule type to schemaa
brokensound77 Dec 7, 2020
b947db2
update threat match schema class names
brokensound77 Dec 7, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions detection_rules/schemas/v7_10.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,24 @@

# rule types
EQL = "eql"
THREAT_MATCH = "threat_match"


class ApiSchema710(ApiSchema79):
"""Schema for siem rule in API format."""

class ThreatMatchEntries(jsl.Document):
"""Threat match rule entries."""

class ThreatMatchEntry(jsl.Document):
"""Threat match rule mapping entry."""

field = jsl.StringField(required=True)
type = jsl.StringField(default='mapping', enum='mapping', required=True)
value = jsl.StringField(required=True)

entries = jsl.ArrayField(jsl.DocumentField(ThreatMatchEntry, required=True), min_items=1)

STACK_VERSION = "7.10"
RULE_TYPES = ApiSchema79.RULE_TYPES + [EQL]

Expand All @@ -32,5 +45,22 @@ class ApiSchema710(ApiSchema79):
eql_scope.language = jsl.StringField(enum=[EQL], required=True, default=EQL)
eql_scope.type = jsl.StringField(enum=[EQL], required=True)

with jsl.Scope(THREAT_MATCH) as tm_scope:
tm_scope.type = jsl.StringField(enum=THREAT_MATCH, required=True)
tm_scope.language = jsl.StringField(enum=['kuery', 'lucene'], required=True, default=EQL)
tm_scope.index = jsl.ArrayField(jsl.StringField(), required=False)
tm_scope.query = jsl.StringField(required=True)
tm_scope.threat_query = jsl.StringField(default='*:*', required=True)
tm_scope.threat_mapping = jsl.ArrayField(jsl.DocumentField(ThreatMatchEntries, required=True), min_items=1)
tm_scope.threat_language = jsl.StringField(enum=['kuery', 'lucene'], required=True, default=EQL)
tm_scope.threat_index = jsl.ArrayField(jsl.StringField(required=True), min_items=1)

# API items not defined here
# filters: filtersOrUndefined,
# savedId: savedIdOrUndefined,
# threatFilters: filtersOrUndefined,
# concurrentSearches: concurrentSearchesOrUndefined,
# itemsPerSearch: itemsPerSearchOrUndefined,

with jsl.Scope(jsl.DEFAULT_ROLE) as default_scope:
default_scope.type = type
6 changes: 4 additions & 2 deletions detection_rules/schemas/v7_8.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,10 @@
MITRE_URL_PATTERN = r'https://attack.mitre.org/{type}/T[A-Z0-9]+/'


# kibana/.../siem/server/lib/detection_engine/routes/schemas/add_prepackaged_rules_schema.ts
# /detection_engine/routes/schemas/schemas.ts
# kibana/.../security_solution/server/lib/detection_engine/routes/schemas/add_prepackaged_rules_schema.ts
# /detection_engine/routes/schemas/schemas.ts
# /detection_engine/schemas/rule_schemas.ts

# rule_id is required here
# output_index is not allowed (and instead the space index must be used)
# immutable defaults to true instead of to false and if it is there can only be true
Expand Down