admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Need to ignore the filter check for input filters

Browse Source
This commit is contained in:
David Dorsey
2020-09-23 11:46:19 -05:00
parent 65403cc027
commit e268e9643f
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/validate.py
+1 -1
View File
@@ -155,7 +155,7 @@ def validate_detection_search(object, macros):
errors.append("ERROR: Missing filter for detection: " + object['name'])
filter_macro = re.search("([a-z0-9_]*_filter)", object['search'])
if filter_macro and filter_macro.group(1) != (object['name'].replace(' ', '_').replace('-', '_').replace('.', '_').replace('/', '_').lower() + '_filter'):
if filter_macro and filter_macro.group(1) != (object['name'].replace(' ', '_').replace('-', '_').replace('.', '_').replace('/', '_').lower() + '_filter') and "input_filter" not in filter_macro.group(1):
errors.append("ERROR: filter for detection: " + object['name'] + " needs to use the name of the detection in lowercase and the special characters needs to be converted into _ .")
if any(x in object['search'] for x in ['eventtype=', 'sourcetype=', ' source=', 'index=']):