|
|
|
@ -103,7 +103,7 @@ def format_webhook(**kwargs):
|
|
|
|
|
notify_message = {
|
|
|
|
|
"rule_id": rule.id,
|
|
|
|
|
"rule_name": rule.name,
|
|
|
|
|
"match": matched,
|
|
|
|
|
"matched": matched,
|
|
|
|
|
"total_hits": total_hits,
|
|
|
|
|
"index": index,
|
|
|
|
|
"data": message,
|
|
|
|
@ -215,6 +215,25 @@ class NotificationRuleData(object):
|
|
|
|
|
self.object.match[index] = False
|
|
|
|
|
self.object.save()
|
|
|
|
|
|
|
|
|
|
def format_matched(self, messages):
|
|
|
|
|
matched = {}
|
|
|
|
|
for message in messages:
|
|
|
|
|
for field, value in self.data:
|
|
|
|
|
if field == "msg":
|
|
|
|
|
# Allow partial matches for msg
|
|
|
|
|
for msg in value:
|
|
|
|
|
if "msg" in message:
|
|
|
|
|
if msg.lower() in message["msg"].lower():
|
|
|
|
|
matched[field] = msg
|
|
|
|
|
# Break out of the msg matching loop
|
|
|
|
|
break
|
|
|
|
|
# Continue to next field
|
|
|
|
|
continue
|
|
|
|
|
if field in message and message[field] in value:
|
|
|
|
|
# Do exact matches for all other fields
|
|
|
|
|
matched[field] = message[field]
|
|
|
|
|
return matched
|
|
|
|
|
|
|
|
|
|
def store_match(self, index, match):
|
|
|
|
|
"""
|
|
|
|
|
Store a match result.
|
|
|
|
@ -293,8 +312,9 @@ class NotificationRuleData(object):
|
|
|
|
|
for agg_name, agg in aggs.items():
|
|
|
|
|
print("ITER", agg_name, agg)
|
|
|
|
|
# Already checked membership below
|
|
|
|
|
op, value = self.aggs[agg_name]
|
|
|
|
|
new_aggs[agg_name] = f"{agg['value']}{op}{value}"
|
|
|
|
|
if agg_name in self.aggs:
|
|
|
|
|
op, value = self.aggs[agg_name]
|
|
|
|
|
new_aggs[agg_name] = f"{agg['value']}{op}{value}"
|
|
|
|
|
|
|
|
|
|
return new_aggs
|
|
|
|
|
|
|
|
|
@ -361,9 +381,11 @@ class NotificationRuleData(object):
|
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
# We hit the return above if we don't need to notify
|
|
|
|
|
if "aggs" in meta and "matched" not in meta:
|
|
|
|
|
meta["matched"] = self.format_matched(message)
|
|
|
|
|
if "aggs" in meta:
|
|
|
|
|
meta["matched"] = self.format_aggs(meta["aggs"])
|
|
|
|
|
print("MATCHED", meta["matched"])
|
|
|
|
|
|
|
|
|
|
rule_notify(self.object, index, message, meta)
|
|
|
|
|
self.store_match(index, message)
|
|
|
|
|
await self.ingest_matches(index, message, meta, mode)
|
|
|
|
|