Merge pull request SigmaHQ#1477 from wagga40/master

Resolves SigmaHQ#1450 - Bug in es-rule backend when using "-r" argument
stboissdev · May 14, 2021 · 6912836 · 6912836
2 parents bd81adc + 534898a
commit 6912836
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/tools/sigma/backends/elasticsearch.py b/tools/sigma/backends/elasticsearch.py
@@ -1381,6 +1381,8 @@ def create_rule(self, configs, index):
             rule.update({"threshold": self.rule_threshold})
         if references:
             rule.update({"references": references})
+        self.rule_type = "query"
+        self.rule_threshold = {}
         return json.dumps(rule)
 
 class KibanaNdjsonBackend(ElasticsearchQuerystringBackend, MultiRuleOutputMixin):