From 64908593d4f1ab1d86e4df7b5e3ef0e802c387eb Mon Sep 17 00:00:00 2001 From: d1vious Date: Tue, 13 Sep 2022 13:11:51 -0400 Subject: [PATCH] adds RBA to correlation rule titles --- .../adapter/templates/savedsearches_detections.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 index c4155ab1a3..0942302162 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 @@ -68,7 +68,7 @@ action.notable = 1 action.notable.param.nes_fields = {{ detection.nes_fields }} {% endif %} action.notable.param.rule_description = {{ detection.deployment.notable.rule_description | custom_jinja2_enrichment_filter(detection) }} -action.notable.param.rule_title = {{ detection.deployment.notable.rule_title | custom_jinja2_enrichment_filter(detection) }} +action.notable.param.rule_title = {% if detection.type | lower == "correlation" %}RBA: {{ detection.deployment.notable.rule_title | custom_jinja2_enrichment_filter(detection) }}{% else %} {{ detection.deployment.notable.rule_title | custom_jinja2_enrichment_filter(detection) }} {% endif +%} action.notable.param.security_domain = {{ detection.tags.security_domain }} action.notable.param.severity = high {% endif %}