From 19f431b6d2e7574259ecd04b4eb4dea5ca7dadc9 Mon Sep 17 00:00:00 2001 From: Thomas Patzke Date: Thu, 12 Sep 2019 00:19:47 +0200 Subject: [PATCH] Changed xpack-watcher dateField default to previous value --- tools/sigma/backends/elasticsearch.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/sigma/backends/elasticsearch.py b/tools/sigma/backends/elasticsearch.py index 9e2878024..99f52cfe6 100644 --- a/tools/sigma/backends/elasticsearch.py +++ b/tools/sigma/backends/elasticsearch.py @@ -452,7 +452,7 @@ class XPackWatcherBackend(ElasticsearchQuerystringBackend, MultiRuleOutputMixin) tags = sigmaparser.parsedyaml.setdefault("tags", "") # Get time frame if exists interval = sigmaparser.parsedyaml["detection"].setdefault("timeframe", "30m") - dateField = self.sigmaconfig.config.get("dateField", "date") + dateField = self.sigmaconfig.config.get("dateField", "timestamp") # creating condition indices = sigmaparser.get_logsource().index