Repository: SigmaHQ/sigma

Issue:
[ElastAlert] Bug rulename
Good morning,

When I convert a rule in ElastAlert format, the name of the rule is the UUID and not the rule title.

Example:
/root/sigma/tools/sigmac -c /root/nxlog.yml --target elastalert rules/windows/process_creation/win_system_exe_anomaly.yml

Result:
```
alert:
- debug
description: Detects a Windows program executable started in a suspicious folder
filter:
- query:
    query_string:
      query: (Image.keyword:(*\\svchost.exe OR *\\rundll32.exe OR *\\services.exe OR *\\powershell.exe OR *\\regsvr32.exe OR *\\spoolsv.exe OR *\\lsass.exe OR *\\smss.exe OR *\\csrss.exe OR *\\conhost.exe OR *\\wininit.exe OR *\\lsm.exe OR *\\winlogon.exe OR *\\explorer.exe OR *\\taskhost.exe) AND (NOT (Image.keyword:(C\:\\Windows\\System32\\* OR C\:\\Windows\\SysWow64\\* OR C\:\\Windows\\SysWOW64\\* OR C\:\\Windows\\explorer.exe OR C\:\\Windows\\winsxs\\* OR C\:\\Windows\\WinSxS\\* OR \\SystemRoot\\System32\\*))))
index: nxlog-*
name: e4a6b256-3e47-40fc-89d2-7a477edd6915_0
priority: 2
realert:
  minutes: 0
type: any
```
The rule name is the UUID.
I have test with the backend option for the rule comment but nothing ...

My Sigma is up-to-date


Discussion:
Hi

I have change the file "sigma/tools/sigma/backends/elasticsearch.py"
I modified the line 836
```
"name": rulename + "_" + str(rule_number),
```
 with 

```
"name": title + "_" + str(rule_number),
```

Now I have:
```
./sigmac -t elastalert -c config/generic/sysmon.yml -c /root/nxlog.yml /root/sigma/rules/windows/process_creation/win_whoami_as_system.yml
```
The result:

```
alert:
- debug
description: Detects a whoami.exe executed by LOCAL SYSTEM. This may be a sign of a successful local privilege escalation.
filter:
- query:
    query_string:
      query: (EventID:"1" AND Channel:"Microsoft\-Windows\-Sysmon\/Operational" AND User:"NT\ AUTHORITY\\SYSTEM" AND Image.keyword:*\\whoami.exe)
index: nxlog-*
name: Run Whoami as SYSTEM_0
priority: 2
realert:
  minutes: 0
type: any

```


I have a problem with my last configuration...
For example, with the rule win_apt_gallium.yml, i have only 1 result:
```
./sigmac -t elastalert -c config/generic/sysmon.yml -c /root/nxlog.yml /root/sigma/rules/windows/process_creation/win_apt_gallium.yml
```
The result:
```
alert:
- debug
description: Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.
filter:
- query:
    query_string:
      query: (EventID:"1" AND Channel:"Microsoft\-Windows\-Sysmon\/Operational" AND Hashes:("e570585edc69f9074cb5e8a790708336bd45ca0f") AND (NOT (Image.keyword:(*\:\\Program\ Files\(x86\)\* OR *\:\\Program\ Files\*))))
index: nxlog-*
name: GALLIUM Artefacts_0
priority: 2
realert:
  minutes: 0
type: any
```

Then , i have changed with:
```
name": title + "_" + rulename,
```
The result is better:

```
alert:
- debug
description: Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.
filter:
- query:
    query_string:
      query: (EventID:"1" AND Channel:"Microsoft\-Windows\-Sysmon\/Operational" AND Hashes:("53a44c2396d15c3a03723fa5e5db54cafd527635" OR "9c5e496921e3bc882dc40694f1dcc3746a75db19" OR "aeb573accfd95758550cf30bf04f389a92922844" OR "79ef78a797403a4ed1a616c68e07fff868a8650a" OR "4f6f38b4cec35e895d91c052b1f5a83d665c2196" OR "1e8c2cac2e4ce7cbd33c3858eb2e24531cb8a84d" OR "e841a63e47361a572db9a7334af459ddca11347a" OR "c28f606df28a9bc8df75a4d5e5837fc5522dd34d" OR "2e94b305d6812a9f96e6781c888e48c7fb157b6b" OR "dd44133716b8a241957b912fa6a02efde3ce3025" OR "8793bf166cb89eb55f0593404e4e933ab605e803" OR "a39b57032dbb2335499a51e13470a7cd5d86b138" OR "41cc2b15c662bc001c0eb92f6cc222934f0beeea" OR "d209430d6af54792371174e70e27dd11d3def7a7" OR "1c6452026c56efd2c94cea7e0f671eb55515edb0" OR "c6b41d3afdcdcaf9f442bbe772f5da871801fd5a" OR "4923d460e22fbbf165bbbaba168e5a46b8157d9f" OR "f201504bd96e81d0d350c3a8332593ee1c9e09de" OR "ddd2db1127632a2a52943a2fe516a2e7d05d70d2"))
index: nxlog-*
name: GALLIUM Artefacts_440a56bf-7873-4439-940a-1c8a671073c2
priority: 2
realert:
  minutes: 0
type: any

alert:
- debug
description: Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.
filter:
- query:
    query_string:
      query: (Channel:"DNS\ Server" AND EventID:"257" AND QNAME:("asyspy256.ddns.net" OR "hotkillmail9sddcc.ddns.net" OR "rosaf112.ddns.net" OR "cvdfhjh1231.myftp.biz" OR "sz2016rose.ddns.net" OR "dffwescwer4325.myftp.biz" OR "cvdfhjh1231.ddns.net"))
index: nxlog-*
name: GALLIUM Artefacts_440a56bf-7873-4439-940a-1c8a671073c2-2
priority: 2
realert:
  minutes: 0
type: any

alert:
- debug
description: Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.
filter:
- query:
    query_string:
      query: (EventID:"1" AND Channel:"Microsoft\-Windows\-Sysmon\/Operational" AND Hashes:("e570585edc69f9074cb5e8a790708336bd45ca0f") AND (NOT (Image.keyword:(*\:\\Program\ Files\(x86\)\* OR *\:\\Program\ Files\*))))
index: nxlog-*
name: GALLIUM Artefacts_440a56bf-7873-4439-940a-1c8a671073c2-3
priority: 2
realert:
  minutes: 0
type: any

```
Can you add this in the elasticsearch.py ?

```
        for parsed in sigmaparser.condparsed:
            #Static data
            rule_object = {
                "name": title + "_" + rulename,
                "description": description,
                "index": index,
                "priority": self.convertLevel(level),
                "realert": self.generateTimeframe(self.realert_time),
                #"exponential_realert": self.generateTimeframe(self.expo_realert_time)
            }

            rule_object['filter'] = self.generateQuery(parsed)
            self.queries = []
```

Resolving patch:
diff --git a/tools/sigma/backends/elasticsearch.py b/tools/sigma/backends/elasticsearch.py
--- a/tools/sigma/backends/elasticsearch.py
+++ b/tools/sigma/backends/elasticsearch.py
@@ -1171,7 +1171,7 @@ def generate(self, sigmaparser):
         for parsed in sigmaparser.condparsed:
             #Static data
             rule_object = {
-                "name": rulename + "_" + str(rule_number),
+                "name": rulename,
                 "description": description,
                 "index": index,
                 "priority": self.convertLevel(level),
diff --git a/tools/sigma/backends/mixins.py b/tools/sigma/backends/mixins.py
--- a/tools/sigma/backends/mixins.py
+++ b/tools/sigma/backends/mixins.py
@@ -68,9 +68,16 @@ def getRuleName(self, sigmaparser):
 
         """
         try:
-            rulename = sigmaparser.parsedyaml["id"]
+            yaml_id = sigmaparser.parsedyaml["id"]
         except KeyError:
-            rulename = sigmaparser.parsedyaml["title"].replace(" ", "-").replace("(", "").replace(")", "")
+            yaml_id = "00000000-0000-0000-0000-000000000000"
+        try:
+            yaml_title = sigmaparser.parsedyaml["title"]
+        except KeyError:
+            yaml_title = "No Title"
+        yaml_title = yaml_title.replace(" ", "-").replace("(", "").replace(")", "")
+        
+        rulename = "%s-%s" % (yaml_id, yaml_title)
         if rulename in self.rulenames:   # add counter if name collides
             cnt = 2
             while "%s-%d" % (rulename, cnt) in self.rulenames:


Test patch: