| 1 | """ |
| 2 | Mapping of Graylog threshold alert SOURCE field values to OpenSearch index patterns. |
| 3 | |
| 4 | When a threshold alert arrives from Graylog, the SOURCE custom field (e.g. "wazuh", "DELLSWITCH") |
| 5 | is used to determine which OpenSearch index pattern to query for the underlying events. |
| 6 | |
| 7 | Add new entries here as new source types are configured in Graylog threshold alert definitions. |
| 8 | """ |
| 9 | |
| 10 | from typing import Dict |
| 11 | from typing import Tuple |
| 12 | |
| 13 | from loguru import logger |
| 14 | |
| 15 | # Maps SOURCE field value (case-insensitive lookup) to (index_pattern, time_field) |
| 16 | SOURCE_TO_INDEX_CONFIG: Dict[str, Tuple[str, str]] = { |
| 17 | "wazuh": ("wazuh-*", "timestamp"), |
| 18 | "office365": ("office365-*", "timestamp"), |
| 19 | } |
| 20 | |
| 21 | |
| 22 | def get_index_config_for_source(source: str) -> Tuple[str, str]: |
| 23 | """ |
| 24 | Look up the OpenSearch index pattern and time field for a given SOURCE value. |
| 25 | |
| 26 | Args: |
| 27 | source: The SOURCE field value from the Graylog threshold alert (e.g. "wazuh", "DELLSWITCH"). |
| 28 | |
| 29 | Returns: |
| 30 | Tuple of (index_pattern, time_field). |
| 31 | |
| 32 | Raises: |
| 33 | ValueError: If the source is not mapped. |
| 34 | """ |
| 35 | config = SOURCE_TO_INDEX_CONFIG.get(source.lower()) |
| 36 | if config is None: |
| 37 | logger.warning( |
| 38 | f"No index mapping configured for threshold alert source '{source}'. " |
| 39 | f"Available sources: {list(SOURCE_TO_INDEX_CONFIG.keys())}", |
| 40 | ) |
| 41 | raise ValueError( |
| 42 | f"No index mapping configured for threshold alert source '{source}'. " |
| 43 | f"Add an entry to SOURCE_TO_INDEX_CONFIG in threshold_index_mapping.py.", |
| 44 | ) |
| 45 | return config |