Skip to content

Conversation

@Mikaayenson
Copy link
Contributor

Issues

#3096

Summary

Refactors the required --> is_required function argument to avoid name collision by new fields like alert_supression in our API schemas.

Testing

Run the CLI python -m detection_rules create-rule test. Should successfully generate a toml file with no errors.

@Mikaayenson Mikaayenson added the bug Something isn't working label Sep 22, 2023
@Mikaayenson Mikaayenson self-assigned this Sep 22, 2023
@Mikaayenson Mikaayenson linked an issue Sep 22, 2023 that may be closed by this pull request
@botelastic botelastic bot added the python Internal python for the repository label Sep 22, 2023
Copy link
Contributor

@eric-forte-elastic eric-forte-elastic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Testing and manual review, LGTM 👍

Test results

detection-rules on  3096-bug-cli-create-rule-crash [$!?] is  v0.1.0 via  v3.8.10 (detection-rules-build) on  eric.forte 
❯ python -m detection_rules create-rule tryagain

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

Rule type (query, saved_query, machine_learning, eql, threshold, threat_match, new_terms): query
actions (multi, comma separated): 

.....

detection-rules on  3096-bug-cli-create-rule-crash [$!?] is  v0.1.0 via  v3.8.10 (detection-rules-build) on  eric.forte 
❯ cat tryagain 
───────┬────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
       │ File: tryagain
───────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   │ [metadata]
   2   │ creation_date = "2023/09/22"
   3   │ maturity = "development"
   4   │ updated_date = "2023/09/22"
   5   │ 
   6   │ [rule]
   7   │ author = ["Test"]
   8   │ description = "Test"
   9   │ language = "kuery"
  10   │ name = "test"
  11   │ risk_score = 47
  12   │ rule_id = "3195cbca-dfdf-49f6-ba3f-7b14f49e1d2e"
  13   │ severity = "low"
  14   │ type = "query"
  15   │ 
  16   │ query = '''
  17   │ event.category:process and event.type:(start or process_started) and process.name:tcpdump
  18   │ '''
  19   │ 
───────┴────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Copy link
Contributor

@terrancedejesus terrancedejesus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good from peer review.

@Mikaayenson Mikaayenson merged commit e4b66c2 into main Sep 28, 2023
@Mikaayenson Mikaayenson deleted the 3096-bug-cli-create-rule-crash branch September 28, 2023 19:28
protectionsmachine pushed a commit that referenced this pull request Sep 28, 2023
protectionsmachine pushed a commit that referenced this pull request Sep 28, 2023
protectionsmachine pushed a commit that referenced this pull request Sep 28, 2023
protectionsmachine pushed a commit that referenced this pull request Sep 28, 2023
protectionsmachine pushed a commit that referenced this pull request Sep 28, 2023
protectionsmachine pushed a commit that referenced this pull request Sep 28, 2023
protectionsmachine pushed a commit that referenced this pull request Sep 28, 2023
protectionsmachine pushed a commit that referenced this pull request Sep 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport: auto bug Something isn't working python Internal python for the repository

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] CLI Create Rule Crash

4 participants