From 062f34c061484c90863fe8254628d56bb78edb6c Mon Sep 17 00:00:00 2001 From: Joanne Wang Date: Wed, 3 Apr 2024 16:52:48 -0700 Subject: [PATCH] fix keywords bug and add comments (#964) Signed-off-by: Joanne Wang --- .../rules/backend/OSQueryBackend.java | 24 ++++++++++++------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/src/main/java/org/opensearch/securityanalytics/rules/backend/OSQueryBackend.java b/src/main/java/org/opensearch/securityanalytics/rules/backend/OSQueryBackend.java index 07455945c..82b769c23 100644 --- a/src/main/java/org/opensearch/securityanalytics/rules/backend/OSQueryBackend.java +++ b/src/main/java/org/opensearch/securityanalytics/rules/backend/OSQueryBackend.java @@ -329,21 +329,35 @@ public Object convertConditionFieldEqValQueryExpr(ConditionFieldEqualsValueExpre return null; }*/ + /** + * Method used when structure of Sigma Rule does not have a field associated with the condition item and the value + * is a SigmaString type + * Ex: + * condition: selection_1 + * selection1: + * - keyword1 + */ @Override public Object convertConditionValStr(ConditionValueExpression condition) throws SigmaValueError { - String field = getFinalValueField(); - ruleQueryFields.put(field, Map.of("type", "text", "analyzer", "rule_analyzer")); SigmaString value = (SigmaString) condition.getValue(); boolean containsWildcard = value.containsWildcard(); return String.format(Locale.getDefault(), (containsWildcard? this.unboundWildcardExpression: this.unboundValueStrExpression), this.convertValueStr((SigmaString) condition.getValue())); } + /** + * Method used when structure of Sigma Rule does not have a field associated with the condition item and the value + * is a SigmaNumber type + */ @Override public Object convertConditionValNum(ConditionValueExpression condition) { return String.format(Locale.getDefault(), this.unboundValueNumExpression, condition.getValue().toString()); } + /** + * Method used when structure of Sigma Rule does not have a field associated with the condition item and the value + * is a SigmaRegularExpression type + */ @Override public Object convertConditionValRe(ConditionValueExpression condition) { return String.format(Locale.getDefault(), this.unboundReExpression, convertValueRe((SigmaRegularExpression) condition.getValue())); @@ -445,12 +459,6 @@ private String getFinalField(String field) { return field; } - private String getFinalValueField() { - String field = "_" + valExpCount; - valExpCount++; - return field; - } - public static class AggregationQueries implements Writeable, ToXContentObject { private static final String AGG_QUERY = "aggQuery"; private static final String BUCKET_TRIGGER_QUERY = "bucketTriggerQuery";