Skip to content

Commit

Permalink
fix pre_detector
Browse files Browse the repository at this point in the history
  • Loading branch information
ekneg54 committed Oct 16, 2023
1 parent 68dd339 commit 4787a8a
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 6 deletions.
9 changes: 8 additions & 1 deletion logprep/processor/base/rule.py
Original file line number Diff line number Diff line change
Expand Up @@ -235,7 +235,14 @@ class Metrics(Component.Metrics):
)
"""Time in seconds that it took to process an event"""

special_field_types = ["regex_fields", "sigma_fields", "ip_fields", "tests", "tag_on_failure"]
special_field_types = [
"regex_fields",
"sigma_fields",
"ip_fields",
"tests",
"tag_on_failure",
"rule_id",
]

@property
def metric_labels(self) -> dict:
Expand Down
10 changes: 5 additions & 5 deletions logprep/processor/pre_detector/rule.py
Original file line number Diff line number Diff line change
Expand Up @@ -95,9 +95,9 @@
:noindex:
"""
from functools import cached_property
from typing import Union, Optional
from typing import Optional, Union

from attrs import define, field, validators, asdict
from attrs import asdict, define, field, validators

from logprep.processor.base.rule import Rule

Expand Down Expand Up @@ -144,11 +144,11 @@ def __eq__(self, other: "PreDetectorRule") -> bool:
# pylint: disable=C0111
@cached_property
def detection_data(self) -> dict:
detection_data = asdict(self._config)
detection_data = asdict(
self._config, filter=lambda attribute, _: attribute.name not in self.special_field_types
)
if self._config.link is None:
del detection_data["link"]
for special_field in Rule.special_field_types:
detection_data.pop(special_field)
return detection_data

@property
Expand Down

0 comments on commit 4787a8a

Please sign in to comment.