Repository: SigmaHQ/sigma

Issue:
Threshold with ES-RULE
Hi,

I have a problem with sigmac and the conversion with "es-rule"
When i do:

```
./sigmac -t es-rule -c config/generic/sysmon.yml -c config/winlogbeat-modules-enabled.yml -I --backend-config /root/sigma/tools/backend.yml /root/sigma/rules/windows/process_creation/win_susp_whoami.yml
```

I have the result:
```
{"description": "Detects the execution of whoami, which is often used by attackers after exloitation / privilege escalation but rarely used by administrators", "enabled": true, "false_positives": ["Admin activity", "Scripts and administrative tools used in the monitored environment", "Monitoring activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "whoami_execution", "language": "lucene", "output_index": ".siem-signals-default", "max_signals": 100, "risk_score": 35, "name": "Whoami Execution", "query": "((winlog.event_id:\"1\" AND winlog.channel:\"Microsoft\\-Windows\\-Sysmon\\/Operational\") AND (process.executable:\"*\\\\whoami.exe\" OR process.pe.original_file_name:\"whoami.exe\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Discovery", "T1033"], "to": "now", "type": "query", "threat": [{"tactic": {"id": "TA0007", "reference": "https://attack.mitre.org/tactics/TA0007", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1033", "name": "System Owner/User Discovery", "reference": "https://attack.mitre.org/techniques/T1033"}]}], "version": 1, "references": ["https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/", "https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/"]}
```
The good result..

But If I do the conversion in recursive...

```
./sigmac -t es-rule -c config/generic/sysmon.yml -c config/winlogbeat-modules-enabled.yml -I --backend-config /root/sigma/tools/backend.yml  -r /root/sigma/rules/windows > /root/rules.ndjson
```

In the "/root/rules.ndjson" , I have another result:

```
{"description": "Detects the execution of whoami, which is often used by attackers after exloitation / privilege escalation but rarely used by administrators", "enabled": true, "false_positives": ["Admin activity", "Scripts and administrative tools used in the monitored environment", "Monitoring activity"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m", "rule_id": "whoami_execution", "language": "lucene", "output_index": ".siem-signals-default", "max_signals": 100, "risk_score": 35, "name": "Whoami Execution", "query": "((winlog.event_id:\"1\" AND winlog.channel:\"Microsoft\\-Windows\\-Sysmon\\/Operational\") AND (process.executable:\"*\\\\whoami.exe\" OR process.pe.original_file_name:\"whoami.exe\"))", "meta": {"from": "1m"}, "severity": "medium", "tags": ["Discovery", "T1033"], "to": "now", "type": "threshold", "threat": [{"tactic": {"id": "TA0007", "reference": "https://attack.mitre.org/tactics/TA0007", "name": "Discovery"}, "framework": "MITRE ATT&CK\u00ae", "technique": [{"id": "T1033", "name": "System Owner/User Discovery", "reference": "https://attack.mitre.org/techniques/T1033"}]}], "version": 1, "threshold": {"field": "process.command_line", "value": 5}, "references": ["https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/", "https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/"]}
```

I have "threshold": {"field": "process.command_line", "value": 5} but it is not normal.


I think there is a problem with the elasticsearch.py:
```
    def generateAggregation(self, agg):
        if agg.aggfunc == SigmaAggregationParser.AGGFUNC_COUNT:
            if agg.cond_op not in [">", ">="]:
                raise NotImplementedError("Threshold rules can only handle > and >= operators")
            if agg.aggfield:
                raise NotImplementedError("Threshold rules cannot COUNT(DISTINCT %s)" % agg.aggfield)
            self.rule_type = "threshold"
            self.rule_threshold = {
                "field": agg.groupfield if agg.groupfield else [],
                "value": int(agg.condition) if agg.cond_op == ">=" else int(agg.condition) + 1
            }
            return ""
        raise NotImplementedError("Aggregation %s is not implemented for this backend" % agg.aggfunc_notrans)
```



Discussion:

Resolving patch:
diff --git a/tools/sigma/backends/elasticsearch.py b/tools/sigma/backends/elasticsearch.py
--- a/tools/sigma/backends/elasticsearch.py
+++ b/tools/sigma/backends/elasticsearch.py
@@ -1381,6 +1381,8 @@ def create_rule(self, configs, index):
             rule.update({"threshold": self.rule_threshold})
         if references:
             rule.update({"references": references})
+        self.rule_type = "query"
+        self.rule_threshold = {}
         return json.dumps(rule)
 
 class KibanaNdjsonBackend(ElasticsearchQuerystringBackend, MultiRuleOutputMixin):


Test patch: