Repository: SigmaHQ/sigma

Issue:
[Backend][Elastalert] group-field for aggregation broken
Hi,

Using `sigma-0.17.0` (installed via pip3) I could not get single _group by_ fields to work. I discovered this while researching for  a possible solution on [supporting multiple fields](https://github.com/Neo23x0/sigma/issues/656).

### Tests
Sigma Version:
```
> pip3 search sigmatools
sigmatools (0.17.0)  - Tools for the Generic Signature Format for SIEM Systems
  INSTALLED: 0.17.0 (latest)
```

`windows/builtin/win_susp_failed_logons_single_source.yml` has the following detection implemented:
```yaml
detection:
    selection1:
        EventID:
            - 529
            - 4625
        UserName: '*'
        WorkstationName: '*'
    selection2:
        EventID: 4776
        UserName: '*'
        Workstation: '*'
    timeframe: 24h
    condition:
        - selection1 | count(UserName) by WorkstationName > 3
        - selection2 | count(UserName) by Workstation > 3
```
Test using `windows/builtin/win_susp_failed_logons_single_source.yml`:
```bash
# sigma commit 71aa8ad3ba248fbcb6df26981e9983e59be971da (HEAD -> master, origin/master, origin/HEAD)
> ./sigmac.py --target elastalert -c sigma-config.yaml ./sigma/rules/windows/builtin/win_susp_failed_logons_single_source.yml -D --verbose
```

### Actual Result
```
An unsupported feature is required for this Sigma rule (./sigma/rules/windows/builtin/win_susp_failed_logons_single_source.yml): fieldNameMapping() takes 3 positional arguments but 4 were given
Feel free to contribute for fun and fame, this is open source :) -> https://github.com/Neo23x0/sigma
```
### Expected Result:
```yaml
alert:
- debug
buffer_time:
  hours: 24
description: Detects suspicious failed logins with different user accounts from a single source system
doc_type: doc
filter:
- query:
    query_string:
      query: (event.id:("529" OR "4625") AND logon_account.keyword:* AND source_workstation.keyword:*)
index: adlog_*
max_threshold: 3
metric_agg_key: logon_account.keyword
metric_agg_type: cardinality
query_key: Workstation.keyword
name: e98374a6-e2d9-4076-9b5c-11bdb2569995_0
priority: 3
realert:
  minutes: 0
type: metric_aggregation

alert:
- debug
buffer_time:
  hours: 24
description: Detects suspicious failed logins with different user accounts from a single source system
doc_type: doc
filter:
- query:
    query_string:
      query: (event.id:"4776" AND logon_account.keyword:* AND source_workstation.keyword:*)
index: adlog_*
max_threshold: 3
metric_agg_key: logon_account.keyword
metric_agg_type: cardinality
query_key: Workstation.keyword
name: e98374a6-e2d9-4076-9b5c-11bdb2569995_1
priority: 3
realert:
  minutes: 0
type: metric_aggregation
```

### Workaround
Not really one but, if I remove the _group by_ clauses, the conversion to elastalert works fine.


### Root cause theory

https://github.com/Neo23x0/sigma/blob/71aa8ad3ba248fbcb6df26981e9983e59be971da/tools/sigma/backends/elasticsearch.py#L1036-L1043

The function call for `fieldNameMapping ` in Line 1040 is wrong. The parameter `True` is an unused parameter. The function `fieldNameMapping` can only be overloaded with 2 Parameters. Removing the `True` parameter produced the expected results.



Discussion:

Resolving patch:
diff --git a/tools/sigma/backends/elasticsearch.py b/tools/sigma/backends/elasticsearch.py
--- a/tools/sigma/backends/elasticsearch.py
+++ b/tools/sigma/backends/elasticsearch.py
@@ -1037,7 +1037,7 @@ def generate(self, sigmaparser):
             if parsed.parsedAgg:
                 if parsed.parsedAgg.aggfunc == sigma.parser.condition.SigmaAggregationParser.AGGFUNC_COUNT or parsed.parsedAgg.aggfunc == sigma.parser.condition.SigmaAggregationParser.AGGFUNC_MIN or parsed.parsedAgg.aggfunc == sigma.parser.condition.SigmaAggregationParser.AGGFUNC_MAX or parsed.parsedAgg.aggfunc == sigma.parser.condition.SigmaAggregationParser.AGGFUNC_AVG or parsed.parsedAgg.aggfunc == sigma.parser.condition.SigmaAggregationParser.AGGFUNC_SUM:
                     if parsed.parsedAgg.groupfield is not None:
-                        rule_object['query_key'] = self.fieldNameMapping(parsed.parsedAgg.groupfield, '*', True)
+                        rule_object['query_key'] = self.fieldNameMapping(parsed.parsedAgg.groupfield, '*')
                     rule_object['type'] = "metric_aggregation"
                     rule_object['buffer_time'] = interval
                     rule_object['doc_type'] = "doc"


Test patch: