Convert Lucene + NDJSON index to variable

[novaksam]

I'm working on generating NDJSON object to import into Kibana, but my windows log event index is 'winlogbeat-' but the output of

pySigma-backend-elasticsearch/sigma/backends/elasticsearch/elasticsearch_lucene.py

Line 347 in fac2fab

index = "beats-*"

appears to only support 'beats-'.

Might it be possible to set this field with a variable supplied in the init so we can pass our own index via the pySigma -O option?

[andurin]

@novaksam Should be easy to implement.

Could you do me the favor and tell me if the kibana ndjson expects the index as comma separated string?

[novaksam]

An example output is

{"id": "fe21810c-2a8c-478f-8dd3-5a287fb2a0e0", "type": "search", "attributes": {"title": "SIGMA - Suspicious Scripting in a WMI Consumer", "description": "Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers", "hits": 0, "columns": [], "sort": ["@timestamp", "desc"], "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"index\": \"beats-*\", \"filter\": [], \"highlight\": {\"pre_tags\": [\"@kibana-highlighted-field@\"], \"post_tags\": [\"@/kibana-highlighted-field@\"], \"fields\": {\"*\": {}}, \"require_field_match\": false, \"fragment_size\": 2147483647}, \"query\": {\"query_string\": {\"query\": \"(process.executable:*new\\\\-object* AND process.executable:*net.webclient* AND process.executable:*.downloadstring*) OR (process.executable:*new\\\\-object* AND process.executable:*net.webclient* AND process.executable:*.downloadfile*) OR (process.executable:(*\\\\ iex\\\\(* OR *\\\\ \\\\-nop\\\\ * OR *\\\\ \\\\-noprofile\\\\ * OR *\\\\ \\\\-decode\\\\ * OR *\\\\ \\\\-enc\\\\ * OR *WScript.Shell* OR *System.Security.Cryptography.FromBase64Transform*))\", \"analyze_wildcard\": true}}}"}}, "references": [{"id": "beats-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern"}]}

So there's the {"searchSourceJSON": "{\"index\": \"beats-*\", entry and "references": [{"id": "beats-*"