File tree Expand file tree Collapse file tree 1 file changed +11
-11
lines changed Expand file tree Collapse file tree 1 file changed +11
-11
lines changed Original file line number Diff line number Diff line change @@ -478,8 +478,17 @@ def validate_detection_against_cms_event(
478
478
self .global_config .app
479
479
)
480
480
481
- # Compare the UUIDs
482
- if cms_uuid != detection .id :
481
+ # Compare the correlation search label
482
+ if cms_event ["action.correlationsearch.label" ] != rule_name_from_detection :
483
+ msg = (
484
+ f"[{ self .infrastructure .instance_name } ][{ detection .name } ]: Correlation search "
485
+ f"label in cms_event ('{ cms_event ['action.correlationsearch.label' ]} ') does not "
486
+ "match detection name"
487
+ )
488
+ self .logger .error (msg )
489
+ return Exception (msg )
490
+ elif cms_uuid != detection .id :
491
+ # Compare the UUIDs
483
492
msg = (
484
493
f"[{ self .infrastructure .instance_name } ] [{ detection .name } ]: UUID in cms_event "
485
494
f"('{ cms_uuid } ') does not match UUID in detection ('{ detection .id } ')"
@@ -496,14 +505,5 @@ def validate_detection_against_cms_event(
496
505
)
497
506
self .logger .error (msg )
498
507
return Exception (msg )
499
- elif cms_event ["action.correlationsearch.label" ] != rule_name_from_detection :
500
- # Compare the correlation search label
501
- msg = (
502
- f"[{ self .infrastructure .instance_name } ][{ detection .name } ]: Correlation search "
503
- f"label in cms_event ('{ cms_event ['action.correlationsearch.label' ]} ') does not "
504
- "match detection name"
505
- )
506
- self .logger .error (msg )
507
- return Exception (msg )
508
508
509
509
return None
You can’t perform that action at this time.
0 commit comments