Update index names in SAP SIEM services
Taylor committed
Feb 14, 2024 at 11:37 UTC
6a8c58fc84d1669bd6189e4ae8445b43d044857f
2 files changed
+4
-5
backend/app/integrations/sap_siem/services/sap_siem_multiple_logins.py
+2
-2
@@ -286,7 +286,7 @@ async def collect_user_activity(suspicious_logins: SuspiciousLogin) -> SapSiemWa
286
"""
287
es_client = await create_wazuh_indexer_client("Wazuh-Indexer")
288
results = es_client.search(
289
- index="integrations_*",
289
+ index="sap_siem_*",
290
body={
291
"size": 1000,
292
"query": {"bool": {"must": [{"term": {"ip": suspicious_logins.ip}}]}},
@@ -306,7 +306,7 @@ async def get_initial_search_results(es_client):
306
dict: The search results.
307
"""
308
return es_client.search(
309
- index="integrations_*",
309
+ index="sap_siem_*",
310
body={
311
"size": 1000,
312
"query": {"bool": {"must": [{"term": {"errMessage": "OK"}}, {"term": {"event_analyzed_multiple_logins": "False"}}]}},
backend/app/integrations/sap_siem/services/sap_siem_suspicious_logins.py
+2
-3
@@ -69,8 +69,7 @@ async def find_suscpicious_logins(threshold: int) -> List[SuspiciousLogin]:
69
if scroll_id is None:
70
# Initial search
71
results = es_client.search(
72
- # ! TODO: change to sap_siem index when ready for deploy
73
- index="integrations_*",
72
+ index="sap_siem_*",
73
body={
74
"size": 10,
75
"query": {"bool": {"must": [{"term": {"case_created": "False"}}, {"term": {"event_analyzed": "False"}}]}},
@@ -117,7 +116,7 @@ async def collect_user_activity(suspicious_logins: SuspiciousLogin) -> SapSiemWa
116
"""
117
es_client = await create_wazuh_indexer_client("Wazuh-Indexer")
118
results = es_client.search(
120
- index="integrations_*",
119
+ index="sap_siem_*",
120
body={
121
"size": 1000,
122
"query": {"bool": {"must": [{"term": {"ip": suspicious_logins.ip}}]}},