Sigma Aggregation rule fixes by sbcd90 · Pull Request #622 · opensearch-project/security-analytics

sbcd90 · 2023-09-30T02:17:07Z

Description

Sigma Aggregation rule fixes

Issues Resolved

Check List

New functionality includes testing.
- All tests pass
New functionality has been documented.
- New functionality has javadoc added
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

codecov · 2023-09-30T02:24:14Z

Codecov Report

Merging #622 (64e5f91) into main (3c9b23a) will increase coverage by 0.04%.
Report is 2 commits behind head on main.
The diff coverage is 62.50%.

@@             Coverage Diff              @@
##               main     #622      +/-   ##
============================================
+ Coverage     25.04%   25.09%   +0.04%     
- Complexity      943      947       +4     
============================================
  Files           255      255              
  Lines         11123    11142      +19     
  Branches       1242     1247       +5     
============================================
+ Hits           2786     2796      +10     
- Misses         8086     8094       +8     
- Partials        251      252       +1

Files	Coverage Δ
...ecurityanalytics/rules/backend/OSQueryBackend.java	`66.81% <100.00%> (ø)`
.../securityanalytics/rules/backend/QueryBackend.java	`64.54% <100.00%> (+0.32%)`	⬆️
...curityanalytics/rules/objects/SigmaDetections.java	`100.00% <100.00%> (ø)`
...a/org/opensearch/securityanalytics/model/Rule.java	`0.00% <0.00%> (ø)`
...tyanalytics/rules/aggregation/AggregationItem.java	`94.73% <66.66%> (-5.27%)`	⬇️
...opensearch/securityanalytics/util/RuleIndices.java	`0.00% <0.00%> (ø)`
...ch/securityanalytics/findings/FindingsService.java	`35.89% <50.00%> (-0.59%)`	⬇️
...lytics/transport/TransportIndexDetectorAction.java	`0.00% <0.00%> (ø)`

... and 1 file with indirect coverage changes

eirsep · 2023-10-02T19:19:09Z

plz update the desription describing the changes being made

eirsep · 2023-10-02T19:22:49Z

src/test/java/org/opensearch/securityanalytics/TestHelpers.java

                "                category: test_category\n" +
                "                product: test_product\n" +
                "            detection:\n" +
+                "                timeframe: 5m\n" +


do we need to add documentation or does sigma have a format which we support for timevalue?

sigma has a format which supports timeframe. https://github.com/SigmaHQ/sigma-specification/blob/main/Sigma_specification.md#timeframe

eirsep · 2023-10-02T19:23:18Z

src/main/java/org/opensearch/securityanalytics/transport/TransportIndexDetectorAction.java

                    : QueryBuilders.boolQuery().must(searchSourceBuilder.query());
                RangeQueryBuilder timeRangeFilter = QueryBuilders.rangeQuery(TIMESTAMP_FIELD_ALIAS)
-                    .gt("{{period_end}}||-1h")
+                    .gt("{{period_end}}||-" + aggItem.getTimeframe())


if timeframe is not set is there a default value

ok fixed this.

Signed-off-by: Subhobrata Dey <sbcd90@gmail.com>

Signed-off-by: Subhobrata Dey <sbcd90@gmail.com> (cherry picked from commit b838dd8)

Signed-off-by: Subhobrata Dey <sbcd90@gmail.com>

* [FEATURE] Improve "list" text area UX opensearch-project#589 Use expression builder instead of code editor Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * [FEATURE] Improve "list" text area UX opensearch-project#589 Use expression builder instead of code editor Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * [FEATURE] Improve "list" text area UX opensearch-project#589 Use expression builder instead of code editor Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * [FEATURE] Improve "list" text area UX opensearch-project#589 Use expression builder instead of code editor Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * Change the order of the sections in the "Create detection rule" page opensearch-project#586 Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * Code review Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * Code review Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * bugfix for tags validation Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * [FEATURE] Change the order of the sections in the "Create detection rule" page opensearch-project#586 [FEATURE] Improve the Create detection rules - selection panel fields error notifications opensearch-project#601 [FEATURE] Improve the Create detection rules - selection panel condition field is not marked as invalid after submission opensearch-project#613 Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * [FEATURE] Change the order of the sections in the "Create detection rule" page opensearch-project#586 [FEATURE] Improve the Create detection rules - selection panel fields error notifications opensearch-project#601 [FEATURE] Improve the Create detection rules - selection panel condition field is not marked as invalid after submission opensearch-project#613 Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * [FEATURE] Replace code editor with expression editor opensearch-project#602 Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * [FEATURE] Replace code editor with expression editor opensearch-project#602 Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * Improve text area ux and add expression UI opensearch-project#603 Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * Cypress cases for detectors and rules, validate forms and fields Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * Cypress cases for detectors and rules, validate forms and fields Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * Cypress cases for detectors and rules, validate forms and fields Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * Cypress cases for detectors and rules, validate forms and fields Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * Cypress cases for detectors and rules, validate forms and fields Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * Cypress cases for detectors and rules, validate forms and fields Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * Cypress cases for detectors and rules, validate forms and fields Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * Cypress cases for detectors and rules, validate forms and fields Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> * Code review Change the order of the sections opensearch-project#622 Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com> --------- Signed-off-by: Jovan Cvetkovic <jovanca.cvetkovic@gmail.com>

…#622) (opensearch-project#623) Signed-off-by: Surya Sashank Nistala <snistala@amazon.com>

Sigma Aggregation rule fixes

add3527

sbcd90 requested review from AWSHurneyt, amsiglan, eirsep, getsaurabh02, lezzago and praveensameneni as code owners September 30, 2023 02:17

eirsep reviewed Oct 2, 2023

View reviewed changes

sbcd90 added 2 commits October 4, 2023 00:34

Sigma Aggregation rule fixes

3f2e23a

Signed-off-by: Subhobrata Dey <sbcd90@gmail.com>

ignore a failed security test

64e5f91

Signed-off-by: Subhobrata Dey <sbcd90@gmail.com>

eirsep approved these changes Oct 4, 2023

View reviewed changes

lezzago approved these changes Oct 4, 2023

View reviewed changes

sbcd90 added backport 2.x backport 2.11 labels Oct 4, 2023

sbcd90 merged commit b838dd8 into opensearch-project:main Oct 4, 2023

opensearch-trigger-bot bot pushed a commit that referenced this pull request Oct 4, 2023

Sigma Aggregation rule fixes (#622)

8baa9f7

Signed-off-by: Subhobrata Dey <sbcd90@gmail.com> (cherry picked from commit b838dd8)

opensearch-trigger-bot bot mentioned this pull request Oct 4, 2023

[Backport 2.x] Sigma Aggregation rule fixes #639

Merged

opensearch-trigger-bot bot pushed a commit that referenced this pull request Oct 4, 2023

Sigma Aggregation rule fixes (#622)

f186c5a

Signed-off-by: Subhobrata Dey <sbcd90@gmail.com> (cherry picked from commit b838dd8)

opensearch-trigger-bot bot mentioned this pull request Oct 4, 2023

[Backport 2.11] Sigma Aggregation rule fixes #640

Merged

sbcd90 pushed a commit that referenced this pull request Oct 4, 2023

Sigma Aggregation rule fixes (#622) (#639)

f733685

Signed-off-by: Subhobrata Dey <sbcd90@gmail.com>

sbcd90 pushed a commit that referenced this pull request Oct 4, 2023

Sigma Aggregation rule fixes (#622) (#640)

088a4aa

Signed-off-by: Subhobrata Dey <sbcd90@gmail.com>

riysaxen-amzn pushed a commit to riysaxen-amzn/security-analytics that referenced this pull request Mar 25, 2024

fix alias exists check in findings index creation (opensearch-project…

88ae55a

…#622) (opensearch-project#623) Signed-off-by: Surya Sashank Nistala <snistala@amazon.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sigma Aggregation rule fixes#622

Sigma Aggregation rule fixes#622
sbcd90 merged 3 commits intoopensearch-project:mainfrom
sbcd90:aggr_fixes

sbcd90 commented Sep 30, 2023

Uh oh!

codecov bot commented Sep 30, 2023 •

edited

Loading

Uh oh!

eirsep commented Oct 2, 2023

Uh oh!

eirsep Oct 2, 2023

Uh oh!

sbcd90 Oct 4, 2023

Uh oh!

eirsep Oct 2, 2023

Uh oh!

sbcd90 Oct 4, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

sbcd90 commented Sep 30, 2023

Description

Issues Resolved

Check List

Uh oh!

codecov bot commented Sep 30, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

eirsep commented Oct 2, 2023

Uh oh!

eirsep Oct 2, 2023

Choose a reason for hiding this comment

Uh oh!

sbcd90 Oct 4, 2023

Choose a reason for hiding this comment

Uh oh!

eirsep Oct 2, 2023

Choose a reason for hiding this comment

Uh oh!

sbcd90 Oct 4, 2023

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov bot commented Sep 30, 2023 •

edited

Loading