From e268e9643f6429811987dda36e40b256fa4ece15 Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Wed, 23 Sep 2020 11:46:19 -0500 Subject: [PATCH] Need to ignore the filter check for input filters --- bin/validate.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/validate.py b/bin/validate.py index 5ab9743aab..c0ecb60a57 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -155,7 +155,7 @@ def validate_detection_search(object, macros): errors.append("ERROR: Missing filter for detection: " + object['name']) filter_macro = re.search("([a-z0-9_]*_filter)", object['search']) - if filter_macro and filter_macro.group(1) != (object['name'].replace(' ', '_').replace('-', '_').replace('.', '_').replace('/', '_').lower() + '_filter'): + if filter_macro and filter_macro.group(1) != (object['name'].replace(' ', '_').replace('-', '_').replace('.', '_').replace('/', '_').lower() + '_filter') and "input_filter" not in filter_macro.group(1): errors.append("ERROR: filter for detection: " + object['name'] + " needs to use the name of the detection in lowercase and the special characters needs to be converted into _ .") if any(x in object['search'] for x in ['eventtype=', 'sourcetype=', ' source=', 'index=']):