Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] Threshold Rule Importing Failures #3547

Closed
Mikaayenson opened this issue Mar 28, 2024 · 0 comments · Fixed by #3560
Closed

[Bug] Threshold Rule Importing Failures #3547

Mikaayenson opened this issue Mar 28, 2024 · 0 comments · Fixed by #3560
Assignees
Labels
bug Something isn't working python Internal python for the repository

Comments

@Mikaayenson
Copy link
Collaborator

Mikaayenson commented Mar 28, 2024

Describe the bug
Related to #3266
Related to #3442

When attempting to use the rule importer for Threshold rules, there appears to some issues with not being able to auto import the threshold values when provided in the ndjson.

Based on this code https://github.com/elastic/detection-rules/blob/main/detection_rules/cli_utils.py#L164-L167, this issue has existed since it was first introduced several years ago most likely because schemas didn't exist at the time.

What we need to do is update the cli_utiles importer to use existing fields if they exist instead of prompting. This should be a relatively small fix.

To Reproduce
Steps to reproduce the behavior:

  1. Export a threshold rule from Kibana
  2. Use the importer `python -m detection_rules import-rules <file.ndjson>
  3. See that the importer tries to prompt for threshold fields even though they exist in the ndjson
Patch rule_prompt

I think we just need to remove the custom prompting logic.

diff --git a/detection_rules/cli_utils.py b/detection_rules/cli_utils.py
index e7b0b4853..4eb865615 100644
--- a/detection_rules/cli_utils.py
+++ b/detection_rules/cli_utils.py
@@ -161,11 +161,6 @@ def rule_prompt(path=None, rule_type=None, required_only=True, save=True, verbos
                 contents[name] = threat_map
             continue
 
-        if name == 'threshold':
-            contents[name] = {n: schema_prompt(f'threshold {n}', is_required=n in options['required'], **opts.copy())
-                              for n, opts in options['properties'].items()}
-            continue
-
         if kwargs.get(name):
             contents[name] = schema_prompt(name, value=kwargs.pop(name))
             continue

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working python Internal python for the repository
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants