SIGMA to ElastAlert bash script

[Jackson-Pollock]

Hi,
I'm working on bash script to convert misp events to sigma rules using sigmai and then sigma to elastalert using sigmac, so the sigmai command will convert misp event to sigma rule and store as random filename uiid.yml (user can't define filename). So I want to use this filename as variable and call in sigmac command as input.

sigmai o/p:
terminal#2021-08-09T09:54:31Z INF saved Sigma rule rule=60118dab-1ab8-40b2-b02b-b6f80aba047c

This will save file called 60118dab-1ab8-40b2-b02b-b6f80aba047c.yml in given path and now I want to use this file 60118dab-1ab8-40b2-b02b-b6f80aba047c.yml as input in sigmac command to convert from sigma to elastalert.

Below is the snip code from shell script.

# if misp_to_sigma_rules enabled, then get MISP events to SIGMA rules
if [[ $misp_to_sigma_rules == "yes" ]];then
	#Convert MISP events to SIGMA using sigmai tool
	#git clone https://github.com/0xThiebaut/sigmai.git
	echo
	echo "converting MISP events to SIGMA rules"
	echo
	/root/sigmai/sigmai_linux_amd64 -t directory --directory-path /root/sigmai/rules/mispsigma -s misp --misp-url $mispurl --misp-key $apikey --misp-events $misp_event_id
else
	:
fi

#read output rule=value and create variable as $how_file_name

# if sigma_to_elastalert_rules enabled, then convert SIGMA to ElastAlert
if [[ $sigma_to_elastalert_rules == "yes" ]];then
	#git clone https://github.com/SigmaHQ/sigma.git
	echo
	echo "Converting SIGMA to ElastAlert"
	echo
    /root/sigma/tools/sigmac -t elastalert -c tools/config/winlogbeat-modules-enabled.yml --backend-option keyword_field="" -o /root/sigmai/rules/mispsigma/$event_id.yml /root/sigmai/rules/mispsigma/mispevent$how_file_name.yml
else
	:
fi

Please suggest how can I define $how_file_name here.

[Jackson-Pollock]

https://github.com/weslambert/misp2elastalert