Skip to content

Be more specific when excluding deprecated detection rules #874

@colleenmcginnis

Description

@colleenmcginnis

Describe the bug

While generating redirects for the detection rule pages, one page was missing that should be on staging (here's the AsciiDoc version of that page: AWS EC2 Deprecated AMI Discovery). I think it's not being included because of this line...

...because the filename contains _deprecated (rules/integrations/aws/discovery_ec2_deprecated_ami_discovery.toml). However, the rule is not deprecated. Instead it's a rule about querying deprecated assets:

Identifies when a user has queried for deprecated Amazon Machine Images (AMIs) in AWS. This may indicate an adversary whom is looking for outdated AMIs that may be vulnerable to exploitation.

Could we be more specific in DetectionRulesDocsBuilderExtension (maybe using something like !f.FullName.Contains("/_deprecated/")) so we exclude rules inside the _deprecated directory, but include rules that might contain the word deprecated in the file name?

Expected behavior

I expect the contents from the rules/integrations/aws/discovery_ec2_deprecated_ami_discovery.toml file to published at https://staging-website.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/discovery_ec2_deprecated_ami_discovery.

Steps to reproduce

No response

Tooling

  • docs-builder
  • migration tooling
  • I'm not sure

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions