in ransomware/artifact.lua [698:748]
function alert.GenerateElasticAlert(processTable, alertProcessData)
local tempMessage = {}
for _, v in pairs(alertProcessData.events) do
tempMessage = {}
tempMessage.path = v.filePath
tempMessage.score = v.alertScore
tempMessage.entropy = v.entropy
tempMessage.extension = v.fileExtension
tempMessage.data = v.headerString
if nil ~= alert.FILE_OP_STR_MAP[v.operation + 1] then
tempMessage.operation = alert.FILE_OP_STR_MAP[v.operation + 1]
end
local metricsCount = 0
for _, v2 in pairs(v.alertMetrics) do
if 0 == metricsCount then
tempMessage.metrics = {}
end
table.insert(tempMessage.metrics, v2)
metricsCount = metricsCount + 1
end
if utils.FILE_RENAME == v.operation then
tempMessage.original = {}
tempMessage.original['path'] = v.filePreviousPath
tempMessage.original['extension'] = v.filePreviousExtension
end
table.insert(processTable.alert_files, tempMessage)
end
end