♻️ Introducing Custom Statuses

[behemothsecurity]

For many Detection Engineering teams, it's important to define their own detection lifecycle. There is so many variants, specificities and different mental models that each team need to take in account, that no standard taxonomy will address completely. We could multiply available statuses, but only to add too many irrelevant options for many.

Thus our new architecture is simple :

• At the framework level, we define Status Strategies that define key behavior : delete a rule, deploy from default branch etc.
• At the instance level, Configurations/deployment.toml contains a new comprehensive structure to create custom statuses, add a description, and assign a strategy.
• And we define a fallback in CoreTide, under the base deployment.toml configuration file, so existing teams are not affected, or if the existing status list is good enough, no perceived change from this release. Any change from the instance configurations immediately replace them with the new values.

[!Naming changes]
We are also introducing naming changes towards the broader vision of #23 , that will start getting ported to tenant strategies and deployment context. For example, the existing PRODUCTION status is using a RELEASE strategy, instead of the previous PRODUCTION concept, which was confusing and overlapping.

Usage

Create custom statuses in your deployment.toml configuration file by adding status definitions

[[statuses]]
name = "My custom status"
description  = "What it does"
strategy = "PREVIEW"

Demo

New options are supported by a schema for ease of use (if the Even Better TOML extension is installed)

Clearer schema descriptions to help understanding what the status will do