Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] Add support for CLI to handle rule ndjson files with extra metadata #82

Closed
brokensound77 opened this issue Jul 21, 2020 · 0 comments · Fixed by #83
Closed

[Bug] Add support for CLI to handle rule ndjson files with extra metadata #82

brokensound77 opened this issue Jul 21, 2020 · 0 comments · Fixed by #83
Assignees
Labels
bug Something isn't working cli command line tooling

Comments

@brokensound77
Copy link
Collaborator

Describe the bug
Exported rules which are in ndjson format have extra metadata which causes importing to fail for several CLI commands.

  • create-rule -c
  • load-from-file
  • view-rule
{"actions":[],"created_at":"2020-07-21T13:52:18.527Z","updated_at":"2020-07-21T13:52:18.544Z","created_by":"elastic","description":"This is a demo of an example rule","enabled":false,"false_positives":["Sometimes cmd is benign :)"],"filters":[],"from":"now-360s","id":"90f6cdcb-6211-4985-ab75-c6253fcdd868","immutable":false,"index":["winlogbeat-*"],"interval":"5m","rule_id":"6b9d2af4-84c8-4e38-a697-2d5d455a9e86","language":"kuery","output_index":".siem-signals-default","max_signals":100,"risk_score":50,"name":"Example Custom Rule","query":"process.name:cmd.exe and process.args:\"-c\"","references":["https://google.com"],"meta":{"from":"1m","kibana_siem_app_url":"https://703efb61c6ee4b14b36f7f4a9674a5ea.us-west-2.aws.found.io:9243/app/siem"},"severity":"low","updated_by":"elastic","tags":["Windows"],"to":"now","type":"query","threat":[{"framework":"MITRE ATT&CK","tactic":{"id":"TA0002","reference":"https://attack.mitre.org/tactics/TA0002","name":"Execution"},"technique":[{"id":"T1064","name":"Scripting","reference":"https://attack.mitre.org/techniques/T1064"}]}],"throttle":"no_actions","note":"## Triage\nWhy are they executing `cmd.exe`?","version":1}
{"exported_count":1,"missing_rules":[],"missing_rules_count":0}

To Reproduce
Steps to reproduce the behavior:

  1. export a rule from kibana
  2. python -m detection_rules -c export.ndjson new_rule.toml --required-only

Expected behavior
The CLI should be updated to be able to understand importing the ndjson formatted rules and ignore extra data. It currently has the ability to parse json, toml, and yaml.

Rules will still need to be able to validate against the schema to be accepted

Additional context
related to #76

@brokensound77 brokensound77 added the bug Something isn't working label Jul 21, 2020
@brokensound77 brokensound77 self-assigned this Jul 21, 2020
@brokensound77 brokensound77 added the cli command line tooling label Jul 21, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working cli command line tooling
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant