EQL sequences syntax under elastalert rule

[securityfai]

Version

2.4.50

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Distributed

Location

airgap

Hardware Specs

Meets minimum requirements

CPU

4

RAM

16

Storage for /

200

Storage for /nsm

200

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I want to use EQL sequences to match ordred series of events. When I did a search request in KIBANA console under Dev tools, I were able to get events that match my query. However, when I used the same syntax in the yaml file of a converted sigma rule to get an alert once the created sequence of events get matched, I got a syntax error.

Below my search under KIBANA:

GET /my-data-stream/_eql/search
{
"query": """
sequence
[ process where process.name == "regsvr32.exe" ]
[ file where stringContains(file.name, "scrobj.dll") ]
"""
}

Next, the syntax under /opt/so/rules/elastalert/playbook/ruleID.yaml

Filter:

• eql: >
  sequence
  [ process where process.name == "regsvr32.exe" ]
  [ file where stringContains(file.name, "scrobj.dll")

---

Any idea of what could be the problem please?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.