Sigma Aggregation rule fixes #622

sbcd90 · 2023-09-30T02:17:07Z

Description

Sigma Aggregation rule fixes

Issues Resolved

Check List

New functionality includes testing.
- All tests pass
New functionality has been documented.
- New functionality has javadoc added
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

codecov · 2023-09-30T02:24:14Z

Codecov Report

Merging #622 (64e5f91) into main (3c9b23a) will increase coverage by 0.04%.
Report is 2 commits behind head on main.
The diff coverage is 62.50%.

@@             Coverage Diff              @@
##               main     #622      +/-   ##
============================================
+ Coverage     25.04%   25.09%   +0.04%     
- Complexity      943      947       +4     
============================================
  Files           255      255              
  Lines         11123    11142      +19     
  Branches       1242     1247       +5     
============================================
+ Hits           2786     2796      +10     
- Misses         8086     8094       +8     
- Partials        251      252       +1

Files	Coverage Δ
...ecurityanalytics/rules/backend/OSQueryBackend.java	`66.81% <100.00%> (ø)`
.../securityanalytics/rules/backend/QueryBackend.java	`64.54% <100.00%> (+0.32%)`	⬆️
...curityanalytics/rules/objects/SigmaDetections.java	`100.00% <100.00%> (ø)`
...a/org/opensearch/securityanalytics/model/Rule.java	`0.00% <0.00%> (ø)`
...tyanalytics/rules/aggregation/AggregationItem.java	`94.73% <66.66%> (-5.27%)`	⬇️
...opensearch/securityanalytics/util/RuleIndices.java	`0.00% <0.00%> (ø)`
...ch/securityanalytics/findings/FindingsService.java	`35.89% <50.00%> (-0.59%)`	⬇️
...lytics/transport/TransportIndexDetectorAction.java	`0.00% <0.00%> (ø)`

... and 1 file with indirect coverage changes

eirsep · 2023-10-02T19:19:09Z

plz update the desription describing the changes being made

eirsep · 2023-10-02T19:22:49Z

src/test/java/org/opensearch/securityanalytics/TestHelpers.java

@@ -588,13 +592,32 @@ public static String productIndexAvgAggRule(){
                "                category: test_category\n" +
                "                product: test_product\n" +
                "            detection:\n" +
+                "                timeframe: 5m\n" +


do we need to add documentation or does sigma have a format which we support for timevalue?

sigma has a format which supports timeframe. https://github.com/SigmaHQ/sigma-specification/blob/main/Sigma_specification.md#timeframe

eirsep · 2023-10-02T19:23:18Z

src/main/java/org/opensearch/securityanalytics/transport/TransportIndexDetectorAction.java

@@ -814,7 +816,7 @@ private IndexMonitorRequest createBucketLevelMonitorRequest(
                    ? new BoolQueryBuilder()
                    : QueryBuilders.boolQuery().must(searchSourceBuilder.query());
                RangeQueryBuilder timeRangeFilter = QueryBuilders.rangeQuery(TIMESTAMP_FIELD_ALIAS)
-                    .gt("{{period_end}}||-1h")
+                    .gt("{{period_end}}||-" + aggItem.getTimeframe())


if timeframe is not set is there a default value

ok fixed this.

Signed-off-by: Subhobrata Dey <[email protected]>

Signed-off-by: Subhobrata Dey <[email protected]> (cherry picked from commit b838dd8)

Signed-off-by: Subhobrata Dey <[email protected]>

* [FEATURE] Improve "list" text area UX opensearch-project#589 Use expression builder instead of code editor Signed-off-by: Jovan Cvetkovic <[email protected]> * [FEATURE] Improve "list" text area UX opensearch-project#589 Use expression builder instead of code editor Signed-off-by: Jovan Cvetkovic <[email protected]> * [FEATURE] Improve "list" text area UX opensearch-project#589 Use expression builder instead of code editor Signed-off-by: Jovan Cvetkovic <[email protected]> * [FEATURE] Improve "list" text area UX opensearch-project#589 Use expression builder instead of code editor Signed-off-by: Jovan Cvetkovic <[email protected]> * Change the order of the sections in the "Create detection rule" page opensearch-project#586 Signed-off-by: Jovan Cvetkovic <[email protected]> * Code review Signed-off-by: Jovan Cvetkovic <[email protected]> * Code review Signed-off-by: Jovan Cvetkovic <[email protected]> * bugfix for tags validation Signed-off-by: Jovan Cvetkovic <[email protected]> * [FEATURE] Change the order of the sections in the "Create detection rule" page opensearch-project#586 [FEATURE] Improve the Create detection rules - selection panel fields error notifications opensearch-project#601 [FEATURE] Improve the Create detection rules - selection panel condition field is not marked as invalid after submission opensearch-project#613 Signed-off-by: Jovan Cvetkovic <[email protected]> * [FEATURE] Change the order of the sections in the "Create detection rule" page opensearch-project#586 [FEATURE] Improve the Create detection rules - selection panel fields error notifications opensearch-project#601 [FEATURE] Improve the Create detection rules - selection panel condition field is not marked as invalid after submission opensearch-project#613 Signed-off-by: Jovan Cvetkovic <[email protected]> * [FEATURE] Replace code editor with expression editor opensearch-project#602 Signed-off-by: Jovan Cvetkovic <[email protected]> * [FEATURE] Replace code editor with expression editor opensearch-project#602 Signed-off-by: Jovan Cvetkovic <[email protected]> * Improve text area ux and add expression UI opensearch-project#603 Signed-off-by: Jovan Cvetkovic <[email protected]> * Cypress cases for detectors and rules, validate forms and fields Signed-off-by: Jovan Cvetkovic <[email protected]> * Cypress cases for detectors and rules, validate forms and fields Signed-off-by: Jovan Cvetkovic <[email protected]> * Cypress cases for detectors and rules, validate forms and fields Signed-off-by: Jovan Cvetkovic <[email protected]> * Cypress cases for detectors and rules, validate forms and fields Signed-off-by: Jovan Cvetkovic <[email protected]> * Cypress cases for detectors and rules, validate forms and fields Signed-off-by: Jovan Cvetkovic <[email protected]> * Cypress cases for detectors and rules, validate forms and fields Signed-off-by: Jovan Cvetkovic <[email protected]> * Cypress cases for detectors and rules, validate forms and fields Signed-off-by: Jovan Cvetkovic <[email protected]> * Cypress cases for detectors and rules, validate forms and fields Signed-off-by: Jovan Cvetkovic <[email protected]> * Code review Change the order of the sections opensearch-project#622 Signed-off-by: Jovan Cvetkovic <[email protected]> --------- Signed-off-by: Jovan Cvetkovic <[email protected]>

…#622) (opensearch-project#623) Signed-off-by: Surya Sashank Nistala <[email protected]>

Sigma Aggregation rule fixes

add3527

sbcd90 requested review from amsiglan, AWSHurneyt, getsaurabh02, lezzago, praveensameneni and eirsep as code owners September 30, 2023 02:17

eirsep reviewed Oct 2, 2023

View reviewed changes

sbcd90 added 2 commits October 4, 2023 00:34

Sigma Aggregation rule fixes

3f2e23a

Signed-off-by: Subhobrata Dey <[email protected]>

ignore a failed security test

64e5f91

Signed-off-by: Subhobrata Dey <[email protected]>

eirsep approved these changes Oct 4, 2023

View reviewed changes

lezzago approved these changes Oct 4, 2023

View reviewed changes

sbcd90 added backport 2.x backport 2.11 labels Oct 4, 2023

sbcd90 merged commit b838dd8 into opensearch-project:main Oct 4, 2023
16 of 17 checks passed

opensearch-trigger-bot bot pushed a commit that referenced this pull request Oct 4, 2023

Sigma Aggregation rule fixes (#622)

8baa9f7

Signed-off-by: Subhobrata Dey <[email protected]> (cherry picked from commit b838dd8)

opensearch-trigger-bot bot mentioned this pull request Oct 4, 2023

[Backport 2.x] Sigma Aggregation rule fixes #639

Merged

opensearch-trigger-bot bot pushed a commit that referenced this pull request Oct 4, 2023

Sigma Aggregation rule fixes (#622)

f186c5a

Signed-off-by: Subhobrata Dey <[email protected]> (cherry picked from commit b838dd8)

opensearch-trigger-bot bot mentioned this pull request Oct 4, 2023

[Backport 2.11] Sigma Aggregation rule fixes #640

Merged

sbcd90 pushed a commit that referenced this pull request Oct 4, 2023

Sigma Aggregation rule fixes (#622) (#639)

f733685

Signed-off-by: Subhobrata Dey <[email protected]>

sbcd90 pushed a commit that referenced this pull request Oct 4, 2023

Sigma Aggregation rule fixes (#622) (#640)

088a4aa

Signed-off-by: Subhobrata Dey <[email protected]>

riysaxen-amzn pushed a commit to riysaxen-amzn/security-analytics that referenced this pull request Mar 25, 2024

fix alias exists check in findings index creation (opensearch-project…

88ae55a

…#622) (opensearch-project#623) Signed-off-by: Surya Sashank Nistala <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sigma Aggregation rule fixes #622

Sigma Aggregation rule fixes #622

sbcd90 commented Sep 30, 2023

codecov bot commented Sep 30, 2023 •

edited

Loading

eirsep commented Oct 2, 2023

eirsep Oct 2, 2023

sbcd90 Oct 4, 2023

eirsep Oct 2, 2023

sbcd90 Oct 4, 2023

Sigma Aggregation rule fixes #622

Sigma Aggregation rule fixes #622

Conversation

sbcd90 commented Sep 30, 2023

Description

Issues Resolved

Check List

codecov bot commented Sep 30, 2023 • edited Loading

Codecov Report

eirsep commented Oct 2, 2023

eirsep Oct 2, 2023

Choose a reason for hiding this comment

sbcd90 Oct 4, 2023

Choose a reason for hiding this comment

eirsep Oct 2, 2023

Choose a reason for hiding this comment

sbcd90 Oct 4, 2023

Choose a reason for hiding this comment

codecov bot commented Sep 30, 2023 •

edited

Loading