Add rule description to enrichment relationship descriptions

misje · May 9, 2024 · 8a8d02d · 8a8d02d
1 parent f4e2608
commit 8a8d02d
Showing 1 changed file with 6 additions and 6 deletions.
diff --git a/src/wazuh/enrich.py b/src/wazuh/enrich.py
@@ -463,7 +463,7 @@ def enrich_files(self, *, incident: stix2.Incident, alerts: list[dict]):
                     created=alert["_source"]["@timestamp"],
                     **self.stix.common_properties,
                     relationship_type="related-to",
-                    description=f"StixFile {match} found in {meta['field']} in alert (ID {alert['_id']}, rule ID {alert['_source']['rule']['id']})",
+                    description=f"StixFile {match} found in {meta['field']} in alert (ID {alert['_id']}, rule ID {alert['_source']['rule']['id']}): {alert['_source']['rule']['description']}",
                     source_ref=incident.id,
                     target_ref=sco_bundle.sco.id,
                 ),
@@ -512,7 +512,7 @@ def enrich_reg_keys(self, *, incident: stix2.Incident, alerts: list[dict]):
                     created=alert["_source"]["@timestamp"],
                     **self.stix.common_properties,
                     relationship_type="related-to",
-                    description=f"Windows-Registry-Key {match} found in {meta['field']} in alert (ID {alert['_id']}, rule ID {alert['_source']['rule']['id']})",
+                    description=f"Windows-Registry-Key {match} found in {meta['field']} in alert (ID {alert['_id']}, rule ID {alert['_source']['rule']['id']}): {alert['_source']['rule']['description']}",
                     source_ref=incident.id,
                     target_ref=sco_bundle.sco.id,
                 ),
@@ -754,7 +754,7 @@ def create_process(
                     created=alert["_source"]["@timestamp"],
                     **self.stix.common_properties,
                     relationship_type="related-to",
-                    description=f"Process found in alert (ID {alert['_id']}, rule ID {alert['_source']['rule']['id']})",
+                    description=f"Process found in alert (ID {alert['_id']}, rule ID {alert['_source']['rule']['id']}): {alert['_source']['rule']['description']}",
                     source_ref=incident.id,
                     target_ref=process.id,
                 ),
@@ -913,7 +913,7 @@ def enrich_traffic(self, *, incident: stix2.Incident, alerts: list[dict]):
                     created=alert["_source"]["@timestamp"],
                     **self.stix.common_properties,
                     relationship_type="related-to",
-                    description=f"Network-Traffic found in alert (ID {alert['_id']}, rule ID {alert['_source']['rule']['id']})",
+                    description=f"Network-Traffic found in alert (ID {alert['_id']}, rule ID {alert['_source']['rule']['id']}): {alert['_source']['rule']['description']}",
                     source_ref=incident.id,
                     target_ref=sco.id,
                 ),
@@ -1078,7 +1078,7 @@ def create_sco(match: Any) -> dict[str, SCOBundle]:
                     created=alert["_source"]["@timestamp"],
                     **self.stix.common_properties,
                     relationship_type="related-to",
-                    description=f"{type} {match} found in {meta['field']} in alert (ID {alert['_id']}, rule ID {alert['_source']['rule']['id']})",
+                    description=f"{type} {match} found in {meta['field']} in alert (ID {alert['_id']}, rule ID {alert['_source']['rule']['id']}): {alert['_source']['rule']['description']}",
                     source_ref=incident.id,
                     target_ref=sco_bundle.sco.id,
                 ),
@@ -1135,7 +1135,7 @@ def create_enrichment_obs_from_search_context(
                     created=alert["_source"]["@timestamp"],
                     **self.stix.common_properties,
                     relationship_type="related-to",
-                    description=f"{type} found in alert (ID {alert['_id']}, rule ID {alert['_source']['rule']['id']})",
+                    description=f"{type} found in alert (ID {alert['_id']}, rule ID {alert['_source']['rule']['id']}): {alert['_source']['rule']['description']}",
                     source_ref=incident.id,
                     target_ref=sco.id,
                 ),