search

airbus-cyber / graylog-plugin-alert-wizard

Alert Wizard plugin for Graylog to manage the alert rules
Other
45 stars 7 forks source link

Log a warning when a rule has multiple distinct_fields #93

Closed frantz45 closed 2 weeks ago

frantz45 commented 1 year ago

From v4.3.0 it's not supported to import a rule with multiple distinct_fields, only the first one is kept. A warning log should be generated when it happens. For example: WARN The rule "rule_title" has multiple distinct_fields, only the first one will be kept ("field_name")

VincentD06 commented 2 weeks ago

I don't reproduce this problem. I try with this file :

2024-06-26_093707_alert_rules.json

Import works with versions 4.3.0, 4.3.1, 4.5.0 and 5.2.0.

VincentD06 commented 2 weeks ago

Seems to be fix in this commit

frantz45 commented 2 weeks ago

There is no bug in this issue, I just want a warning log when there are multiple distinct_fields because only the first one is kept.

VincentD06 commented 2 weeks ago

OK. I added a user notification on the import page when this case appears.

frantz45 commented 2 weeks ago

I confirm it's fixed in v5.2.1