fix: sanitize customer name in cluster_node field for event stream configuration (#398)
taylor_socfortress committed
Jan 28, 2025 at 13:47 UTC
03bdea4c1c91f7bcded2bc02f63cc8a374ffcaac
1 file changed
+2
-1
backend/app/customer_provisioning/services/graylog.py
+2
-1
@@ -126,6 +126,7 @@ def build_event_stream_config(
126
Returns:
127
WazuhEventStream: The configured Wazuh event stream.
128
"""
129
+ sanitized_name = request.customer_name.replace(" ", "_")
130
return WazuhEventStream(
131
title=f"{request.customer_name} - Wazuh EDR EVENTS",
132
description=f"{request.customer_name} - Wazuh EDR EVENTS",
@@ -137,7 +138,7 @@ def build_event_stream_config(
138
"inverted": False,
139
"value": request.customer_code,
140
},
140
- {"field": "cluster_node", "type": 1, "inverted": False, "value": f"wazuh.worker.{request.customer_name}"},
141
+ {"field": "cluster_node", "type": 1, "inverted": False, "value": f"wazuh.worker.{sanitized_name}"},
142
],
143
matching_type="OR",
144
remove_matches_from_default_stream=True,