Skip to content

Conversation

Mpdreamz
Copy link
Member

@Mpdreamz Mpdreamz commented Mar 19, 2025

Adds support for:

  • Filtering _deprecated rules
  • Including ../rules_building_block

As per feedback on elastic/detection-rules#4508

This also adds all the remaining metadata I have access too:

  • Adding threat information to the documentation page.

Preview:

cursorful-video-1742420321022.mp4

@Copilot Copilot AI review requested due to automatic review settings March 19, 2025 21:34
@Mpdreamz Mpdreamz requested a review from a team as a code owner March 19, 2025 21:34
@Mpdreamz Mpdreamz added the fix label Mar 19, 2025
@Mpdreamz Mpdreamz self-assigned this Mar 19, 2025
Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR updates the detection rules extension to support displaying threat information, refines markdown rendering for detection rules, and adds fallbacks for the "kuery" and "lucene" languages. Key changes include:

  • Enhancements in DetectionRuleFile.cs to incorporate threat details and improved markdown construction.
  • Updates in DetectionRule.cs to support new threat, tactic, and technique records and safer integer parsing.
  • Modifications in navigation and configuration classes to align with the new detection rules structure.

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file
File Description
src/Elastic.Markdown/Extensions/DetectionRules/DetectionRuleFile.cs Updates markdown generation to include additional threat information and detail formatting changes.
src/Elastic.Markdown/Extensions/DetectionRules/DetectionRule.cs Adds records for threat, tactic, and technique; updates risk score parsing.
src/Elastic.Markdown/Myst/CodeBlocks/EnhancedCodeBlockParser.cs Updates fallback mappings for "kuery" and "lucene" languages in code block parsing.
src/Elastic.Markdown/Extensions/DetectionRules/DetectionRulesDocsBuilderExtension.cs Adjusts ToC creation and navigation injection behavior for detection rules.
src/Elastic.Markdown/IO/Configuration/TableOfContentsConfiguration.cs Modifies detection rules configuration to support multiple folders and string array input.
src/Elastic.Markdown/Extensions/DetectionRules/DetectionRulesReference.cs Removes the RulesFolderReference record to clean up references.
Comments suppressed due to low confidence (3)

src/Elastic.Markdown/Extensions/DetectionRules/DetectionRulesDocsBuilderExtension.cs:17

  • Changing the InjectsIntoNavigation method to always return false may affect expected navigation behavior; please confirm if this adjustment is intended for the detection rules docs.
public bool InjectsIntoNavigation(ITocItem tocItem) => false;

src/Elastic.Markdown/Myst/CodeBlocks/EnhancedCodeBlockParser.cs:99

  • [nitpick] The fallback mapping for 'kuery' and 'lucene' appears in the switch expression; consider centralizing this configuration to reduce duplication and avoid potential inconsistencies in language assignment.
    //TODO support these natively

src/Elastic.Markdown/Extensions/DetectionRules/DetectionRule.cs:100

  • Defaulting the risk score to 0 when not found might mask configuration errors; please verify that this fallback behavior is acceptable.
RiskScore = TryGetInt(rule, "risk_score") ?? 0,

@Mpdreamz Mpdreamz changed the title feature/detection rules update Update detection rule extension to be more feature complete Mar 19, 2025
@Mpdreamz Mpdreamz merged commit 63cf05e into main Mar 19, 2025
10 checks passed
@Mpdreamz Mpdreamz deleted the feature/detection-rules-update branch March 19, 2025 22:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants