diff --git a/tools/sigma/backends/elasticsearch.py b/tools/sigma/backends/elasticsearch.py index a60c8cc3a9f..1c1d5e91cc6 100644 --- a/tools/sigma/backends/elasticsearch.py +++ b/tools/sigma/backends/elasticsearch.py @@ -1381,6 +1381,8 @@ def create_rule(self, configs, index): rule.update({"threshold": self.rule_threshold}) if references: rule.update({"references": references}) + self.rule_type = "query" + self.rule_threshold = {} return json.dumps(rule) class KibanaNdjsonBackend(ElasticsearchQuerystringBackend, MultiRuleOutputMixin):