Add kind keyword for detection event detail search

Close: #390
petabi · Jan 4, 2025 · 466c334 · 466c334
1 parent 35b9d80
commit 466c334
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 5 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,6 +11,9 @@ Versioning](https://semver.org/spec/v2.0.0.html).
 
 - Added `Account::theme` field to represent user's selected screen color theme
   on the user interface.
+- Added kind keywords for detailed searching of `RepeatedHttpSessions`,
+  `NonBrowser`,`ExternalDdos`, `CryptocurrencyMiningPool`, `BlockListDceRpc`
+  detection events.
 
 ### Changed
 

diff --git a/src/event.rs b/src/event.rs
@@ -1833,7 +1833,7 @@ impl EventFilter {
             moderate_kinds_by(kinds, &["dns", "covert", "channel"], "dns covert channel");
             moderate_kinds_by(
                 kinds,
-                &["http", "covert", "channel"],
+                &["http", "covert", "channel", "repeated", "http", "sessions"],
                 "repeated http sessions",
             );
             moderate_kinds_by(kinds, &["rdp", "brute", "force"], "rdp brute force");
@@ -1848,17 +1848,25 @@ impl EventFilter {
                 &["multi", "host", "port", "scan"],
                 "multi host port scan",
             );
-            moderate_kinds_by(kinds, &["external", "ddos"], "external ddos");
+            moderate_kinds_by(kinds, &["external", "ddos", "dos"], "external ddos");
             moderate_kinds_by(kinds, &["port", "scan"], "port scan");
-            moderate_kinds_by(kinds, &["non", "browser"], "non browser");
             moderate_kinds_by(
                 kinds,
-                &["cryptocurrency", "mining", "pool"],
+                &["non", "browser", "non-browser", "connection"],
+                "non browser",
+            );
+            moderate_kinds_by(
+                kinds,
+                &["cryptocurrency", "mining", "pool", "network", "connection"],
                 "cryptocurrency mining pool",
             );
             moderate_kinds_by(kinds, &["block", "list", "bootp"], "block list bootp");
             moderate_kinds_by(kinds, &["block", "list", "conn"], "block list conn");
-            moderate_kinds_by(kinds, &["block", "list", "dcerpc"], "block list dcerpc");
+            moderate_kinds_by(
+                kinds,
+                &["block", "list", "dcerpc", "dce/rpc"],
+                "block list dcerpc",
+            );
             moderate_kinds_by(kinds, &["block", "list", "dhcp"], "block list dhcp");
             moderate_kinds_by(kinds, &["block", "list", "dns"], "block list dns");
             moderate_kinds_by(kinds, &["block", "list", "ftp"], "block list ftp");