File tree Expand file tree Collapse file tree 1 file changed +11
-11
lines changed
Expand file tree Collapse file tree 1 file changed +11
-11
lines changed Original file line number Diff line number Diff line change @@ -478,8 +478,17 @@ def validate_detection_against_cms_event(
478478 self .global_config .app
479479 )
480480
481- # Compare the UUIDs
482- if cms_uuid != detection .id :
481+ # Compare the correlation search label
482+ if cms_event ["action.correlationsearch.label" ] != rule_name_from_detection :
483+ msg = (
484+ f"[{ self .infrastructure .instance_name } ][{ detection .name } ]: Correlation search "
485+ f"label in cms_event ('{ cms_event ['action.correlationsearch.label' ]} ') does not "
486+ "match detection name"
487+ )
488+ self .logger .error (msg )
489+ return Exception (msg )
490+ elif cms_uuid != detection .id :
491+ # Compare the UUIDs
483492 msg = (
484493 f"[{ self .infrastructure .instance_name } ] [{ detection .name } ]: UUID in cms_event "
485494 f"('{ cms_uuid } ') does not match UUID in detection ('{ detection .id } ')"
@@ -496,14 +505,5 @@ def validate_detection_against_cms_event(
496505 )
497506 self .logger .error (msg )
498507 return Exception (msg )
499- elif cms_event ["action.correlationsearch.label" ] != rule_name_from_detection :
500- # Compare the correlation search label
501- msg = (
502- f"[{ self .infrastructure .instance_name } ][{ detection .name } ]: Correlation search "
503- f"label in cms_event ('{ cms_event ['action.correlationsearch.label' ]} ') does not "
504- "match detection name"
505- )
506- self .logger .error (msg )
507- return Exception (msg )
508508
509509 return None
You can’t perform that action at this time.
0 commit comments