updating hawk field translation, and bug when an author field is not present in a sig

This commit is contained in:
Tim Shelton
2022-04-28 19:54:00 +00:00
parent b1c9a19f37
commit eb0bcd7c9f
2 changed files with 5 additions and 2 deletions
+1 -1
View File
@@ -562,4 +562,4 @@ fieldmappings:
sc-bytes: http_content_length
user-agent: http_user_agent
cs-User-Agent: http_user_agent
r-dns: ip_dst_host
r-dns: http_host
+4 -1
View File
@@ -643,7 +643,10 @@ class HAWKBackend(SingleTextQueryBackend):
raise Exception("Failed to parse json: %s" % analytic_txt)
cmt = "Sigma Rule: %s\n" % sigmaparser.parsedyaml['id']
cmt += "Author: %s\n" % sigmaparser.parsedyaml['author']
if 'author' in sigmaparser.parsedyaml:
cmt += "Author: %s\n" % sigmaparser.parsedyaml['author']
else:
cmt += "Author: Unknown\n"
cmt += "Level: %s\n" % sigmaparser.parsedyaml['level']
if 'falsepositives' in sigmaparser.parsedyaml and type(sigmaparser.parsedyaml['falsepositives']) is list:
if len(sigmaparser.parsedyaml['falsepositives']) > 0: