[FEATURE] SigmaRule Parser - Remove replacing "." to "_" in field names

[petardz]

Is your feature request related to a problem?
During first release of SAP we had issues with fields containing "." in sigma rules. That issue was fixed since then and we don't have a need for replacing "." char in field names anymore.

What solution would you like?
Remove replacing "." characters.

[jinalp-crest]

@eirsep and @petardz Just wanted to confirm that there are aliases that we see on the detector mapping screen. So, as per the configured rules, we provide mapping for the aliases against our field present in the index.

I have tried with the sigma rule while configuring the cloudtrail detector, so at that time I was not able to map the field "userIdentity.type", I see there is alias called aws-cloudtrail-user_identity-type, but I don't see any mappings for the same in security analytics repository. So, I guess this is the issue.

Also, I'm able to generate findings for all the flattened data with the sigma rule configuration. But, somehow, I am not able to generate findings/alerts for the nested json data (which is parsed and ingested as per the ECS format). So can anyone help me understand what I might be missing?

Just to share context, I am using Security Analytics Plugin from the OpenSearch version 2.6x (latest), which is running on docker image. For detector configuration, I have used cloudtrail detector with all 31 out-of-the-box sigma rules available.

References:

• https://forum.opensearch.org/t/mappings-in-security-analytics-plugin/12502/3
• https://opensearch.org/docs/2.6/security-analytics/

[petardz]

@jinalp-crest

You're right, mappings are buggy in 2.6. There are also other examples where this is a case. You can work around this temporary, by defining alias mappings in your index manually:

PUT my_index/_mapping
{
  "properties": {
    "aws-cloudtrail-user_identity-type": {
      "type": "alias",
      "path": "my_index_field"
    }
  }
}

Also, I'm able to generate findings for all the flattened data with the sigma rule configuration. But, somehow, I am not able to generate findings/alerts for the nested json data (which is parsed and ingested as per the ECS format). So can anyone help me understand what I might be missing?

This issue is in Alerting and it is addressed by this PR: link

[amsiglan]

Fixed in 2.9