patch after we broke alarms due to field name changes
@@ -102,10 +102,10 @@ class alarm():
rAlarmed.append(ip)
if ip['_source']['redirtraffic.sourceip'] not in UniqueIPs:
UniqueIPs[ip['_source']['redirtraffic.sourceip']] = {}
- if 'redirtraffic.httprequest' in line['_source']:
- UniqueLINEs[line['_source']['redirtraffic.sourceip']]['redirtraffic.httprequest'] = line['_source']['redirtraffic.httprequest']
- if 'redirtraffic.sourceip' in line['_source']:
- UniqueLINEs[line['_source']['redirtraffic.sourceip']]['redirtraffic.sourceip'] = line['_source']['redirtraffic.sourceip']
+ if 'redirtraffic.httprequest' in ip['_source']:
+ UniqueIPs[ip['_source']['redirtraffic.sourceip']]['redirtraffic.httprequest'] = ip['_source']['redirtraffic.httprequest']
+ if 'redirtraffic.sourceip' in ip['_source']:
+ UniqueIPs[ip['_source']['redirtraffic.sourceip']]['redirtraffic.sourceip'] = ip['_source']['redirtraffic.sourceip']
if 'timezone' in ip['_source']['geoip']:
UniqueIPs[ip['_source']['redirtraffic.sourceip']]['timezone'] = ip['_source']['geoip']['timezone']
if 'as_org' in ip['_source']['geoip']:
