admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

[TR-82] code cleanup for generate.py

Browse Source
This commit is contained in:
jzsplunk
2020-08-18 13:21:33 -07:00
parent 84283e4123
commit 45c0efe7ee
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/generate.py
+7 -4
View File
@@ -74,6 +74,13 @@ def generate_collections_conf(lookups):
def generate_savedsearches_conf(detections, response_tasks, baselines, deployments):
'''
@param detections: input list of individual YAML detections in detections/ directory
@param response_tasks:
@param baselines:
@param deployments:
@return: the savedsearches.conf file located in package/default/
'''
for detection in detections:
# parse out data_models
@@ -91,7 +98,6 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'security_domain', 'asset_type', 'risk_object', 'risk_object_type', 'risk_score']
mappings = {}
for key in keys:
#print(key)
if key == 'mitre_attack':
if 'mitre_attack_id' in detection['tags']:
mappings[key] = detection['tags']['mitre_attack_id']
@@ -102,13 +108,10 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
if 'risk_object' in detection['tags']:
detection['risk_object'] = detection['tags']['risk_object']
print(detection['tags']['risk_object'])
if 'risk_object_type' in detection['tags']:
detection['risk_object_type'] = detection['tags']['risk_object_type']
print(detection['tags']['risk_object_type'])
if 'risk_score' in detection['tags']:
detection['risk_score'] = detection['tags']['risk_score']
print(detection['tags']['risk_score'])
for baseline in baselines:
data_model = parse_data_models_from_search(baseline['search'])