function alert.GenerateElasticAlert()

in ransomware/artifact.lua [698:748]


function alert.GenerateElasticAlert(processTable, alertProcessData)
    local tempMessage = {}
    for _, v in pairs(alertProcessData.events) do
        
        
        
        
        
        
        
        
        
        
        
        
        tempMessage = {}
        tempMessage.path = v.filePath
        tempMessage.score = v.alertScore
        tempMessage.entropy = v.entropy
        tempMessage.extension = v.fileExtension
        tempMessage.data = v.headerString

        
        
        if nil ~= alert.FILE_OP_STR_MAP[v.operation + 1] then
            tempMessage.operation = alert.FILE_OP_STR_MAP[v.operation + 1]
        end

        local metricsCount = 0

        for _, v2 in pairs(v.alertMetrics) do
            if 0 == metricsCount then
                tempMessage.metrics = {}
            end

            table.insert(tempMessage.metrics, v2)
            metricsCount = metricsCount + 1
        end

        if utils.FILE_RENAME == v.operation then
            tempMessage.original = {}
            tempMessage.original['path'] = v.filePreviousPath
            tempMessage.original['extension'] = v.filePreviousExtension
        end

        
        
        
        table.insert(processTable.alert_files, tempMessage)
    end
end