Fixes in es-rule backend

thomaspatzke · thomaspatzke · commit d9b48ea747ee · 2020-02-24T23:20:19.000+01:00
diff --git a/tools/sigma/backends/elasticsearch.py b/tools/sigma/backends/elasticsearch.py
@@ -18,6 +18,8 @@
 import re
 from fnmatch import fnmatch
 import sys
+import os
+from random import randrange
 
 import sigma
 import yaml
@@ -992,17 +994,15 @@ def generateQuery(self, parsed):
         #Generate ES QS Query
         return [{ 'query' : { 'query_string' : { 'query' : super().generateQuery(parsed) } } }]
 
-
 class ElasticSearchRuleBackend(ElasticsearchQuerystringBackend):
-    identifier = "elasticsearch-rule"
+    identifier = "es-rule"
     active = True
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.tactics = self._load_mitre_file("tactics")
         self.techniques = self._load_mitre_file("techniques")
 
-
     def _load_mitre_file(self, mitre_type):
         try:
             backend_dir = os.path.normpath(os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "config", "mitre"))
@@ -1013,7 +1013,7 @@ def _load_mitre_file(self, mitre_type):
         except (IOError, OSError) as e:
             print("Failed to open {} configuration file '%s': %s".format(path, str(e)), file=sys.stderr)
             return []
-        except json.JSONDecoder as e:
+        except json.JSONDecodeError as e:
             print("Failed to parse {} configuration file '%s' as valid YAML: %s" % (path, str(e)), file=sys.stderr)
             return []
 
@@ -1025,7 +1025,6 @@ def generate(self, sigmaparser):
             rule = self.create_rule(configs)
             return rule
 
-
     def create_threat_description(self, tactics_list, techniques_list):
         threat_list = list()
         for tactic in tactics_list:
@@ -1134,4 +1133,4 @@ def create_rule(self, configs):
             "threat": threat,
             "version": 1
         }
-        return json.dumps(rule)
+        return json.dumps(rule)
