Dont incident_enrichment if is already enriched

redBorder · Dec 25, 2024 · 69bb4b7 · 69bb4b7
1 parent 43b5113
commit 69bb4b7
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 13 deletions.
diff --git a/resources/templates/default/intrusion_incident_enrichment.conf.erb b/resources/templates/default/intrusion_incident_enrichment.conf.erb
@@ -1,7 +1,9 @@
 filter {
-  incident_enrichment { 
-    incident_fields => ["src","src_port", "dst", "dst_port"]
-    source => "redBorder Intrusion"
-    incidents_priority_filter => "<%= @intrusion_incidents_priority_filter %>"
+  if ![incident_uuid] {
+    incident_enrichment { 
+      incident_fields => ["src","src_port", "dst", "dst_port"]
+      source => "redBorder Intrusion"
+      incidents_priority_filter => "<%= @intrusion_incidents_priority_filter %>"
+    }
   }
 }
diff --git a/resources/templates/default/vault_incident_enrichment.conf.erb b/resources/templates/default/vault_incident_enrichment.conf.erb
@@ -1,13 +1,15 @@
 filter {
-  incident_enrichment {
-    incident_fields => ["fromhost_ip"]
-    source => "redBorder Vault"
-    incidents_priority_filter => "<%= @vault_incidents_priority_filter %>"
-    field_scores => {
-      "fromhost_ip" => 100
-    }
-    field_map => {
-      "fromhost_ip" => "ip"
+  if ![incident_uuid] {
+    incident_enrichment {
+      incident_fields => ["fromhost_ip"]
+      source => "redBorder Vault"
+      incidents_priority_filter => "<%= @vault_incidents_priority_filter %>"
+      field_scores => {
+        "fromhost_ip" => 100
+      }
+      field_map => {
+        "fromhost_ip" => "ip"
+      }
     }
   }
 }