diff --git a/src/main/java/org/opensearch/securityanalytics/util/RuleIndices.java b/src/main/java/org/opensearch/securityanalytics/util/RuleIndices.java index 53c0a516f..18037fd11 100644 --- a/src/main/java/org/opensearch/securityanalytics/util/RuleIndices.java +++ b/src/main/java/org/opensearch/securityanalytics/util/RuleIndices.java @@ -4,6 +4,7 @@ */ package org.opensearch.securityanalytics.util; +import java.util.HashSet; import java.util.Set; import com.google.common.collect.ImmutableMap; @@ -70,6 +71,7 @@ import java.util.Locale; import java.util.Map; import java.util.Objects; +import java.util.UUID; import java.util.stream.Collectors; import java.util.stream.Stream; @@ -272,10 +274,13 @@ private String getRuleCategory(Path folderPath) { private void ingestQueries(Map> logIndexToRules, WriteRequest.RefreshPolicy refreshPolicy, TimeValue indexTimeout, ActionListener listener) throws SigmaError, IOException { List queries = new ArrayList<>(); + Set ruleIds = new HashSet<>(); for (Map.Entry> logIndexToRule: logIndexToRules.entrySet()) { Map fieldMappings = logTypeService.getRuleFieldMappingsForBuiltinLogType(logIndexToRule.getKey()); final QueryBackend backend = new OSQueryBackend(fieldMappings, true, true); - queries.addAll(getQueries(backend, logIndexToRule.getKey(), logIndexToRule.getValue())); + List rules = getQueries(backend, logIndexToRule.getKey(), logIndexToRule.getValue(), ruleIds); + rules.forEach(rule -> ruleIds.add(rule.getId())); + queries.addAll(rules); } loadRules(queries, refreshPolicy, indexTimeout, listener, true); } @@ -285,16 +290,18 @@ private void loadQueries(String[] paths, WriteRequest.RefreshPolicy refreshPolic loadQueries(path, refreshPolicy, indexTimeout, listener); } - private List getQueries(QueryBackend backend, String category, List rules) throws SigmaError { + private List getQueries(QueryBackend backend, String category, List rules, Set ruleIds) throws SigmaError { List queries = new ArrayList<>(); for (String ruleStr: rules) { SigmaRule rule = SigmaRule.fromYaml(ruleStr, true); backend.resetQueryFields(); List ruleQueries = backend.convertRule(rule); Set queryFieldNames = backend.getQueryFields().keySet(); + String ruleId = ruleIds.contains(rule.getId().toString()) ? + UUID.randomUUID().toString() : rule.getId().toString(); Rule ruleModel = new Rule( - rule.getId().toString(), NO_VERSION, rule, category, + ruleId, NO_VERSION, rule, category, ruleQueries, new ArrayList<>(queryFieldNames), ruleStr