diff --git a/tools/sigma/backends/limacharlie.py b/tools/sigma/backends/limacharlie.py index ce0412b38..3b8c8236f 100644 --- a/tools/sigma/backends/limacharlie.py +++ b/tools/sigma/backends/limacharlie.py @@ -291,11 +291,14 @@ class LimaCharlieBackend(BaseBackend): if ruleConfig.get("author", None) is not None: respondComponents[0].setdefault("metadata", {})["author"] = ruleConfig["author"] + if ruleConfig.get("falsepositives", None) is not None: + respondComponents[0].setdefault("metadata", {})["falsepositives"] = ruleConfig["falsepositives"] + # Assemble it all as a single, complete D&R rule. return yaml.safe_dump({ "detect": detectComponent, "respond": respondComponents, - }) + }, default_flow_style = False) def generateQuery(self, parsed): # We override the generateQuery function because