Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] Threshold Rule Conversion to TOML not working as expected #3442

Closed
Lexinga opened this issue Feb 13, 2024 · 0 comments
Closed

[Bug] Threshold Rule Conversion to TOML not working as expected #3442

Lexinga opened this issue Feb 13, 2024 · 0 comments
Assignees
Labels
bug Something isn't working community

Comments

@Lexinga
Copy link

Lexinga commented Feb 13, 2024

Describe the bug
python.exe -m detection_rules import-rules anytresholdrule_with_groupby_and_cardinalityfield.ndjson
Does not convert the rule to TOML, but it rather prompts for additional input (like cardinality, field name and field value). Furthermore, it does not seem possible to use both a group_by and a count field with corresponding values.

To Reproduce
Steps to reproduce the behavior:

  1. Create a Threshold Rule with group by field and count field, fill values
  2. export to ndjson
  3. try to convert using the python module -> python.exe -m detection_rules import-rules rule.ndjson
  4. See behaviour

Expected behavior
It should not prompt for anything. And it should be clear how to fill the prompts as in the UI.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working community
Projects
None yet
Development

No branches or pull requests

2 participants