Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FR] [DAC] Add exceptions list and action connector text to import-rules logging messages #4092

Closed
eric-forte-elastic opened this issue Sep 19, 2024 · 0 comments · Fixed by #4093
Assignees

Comments

@eric-forte-elastic
Copy link
Contributor

Repository Feature

Detections-as-Code (DaC) - (primarily custom rule management)

Problem Description

Currently in the Kibana import-rules command the text output does not show information as to what exception lists and action connectors were also successfully (or unsuccessfully) uploaded. Export rules does provide this information and it would be nice.

This is coming from a community slack comment.

Details

detection-rules on  main [$!?] is  v0.1.0 via  v3.12.6 (test_venv) on  eric.forte took 3s 
❯ python -m detection_rules kibana --space prod import-rules -o -e -ac -d dac_test/rules
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

2 rule(s) successfully imported
 - 794d2fc0-ecd0-4963-99da-fd587666b80d
 - e8e3af2a-11b8-4ab7-9ca1-c6db621ea89d
detection-rules on  main [$!?] is  v0.1.0 via  v3.12.6 (test_venv) on  eric.forte took 6s 
❯ python -m detection_rules kibana --space prod export-rules -e -ac -d dac_test/rules/
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

4 results exported
2 rules converted
0 exceptions exported
1 action connectors exported
2 rules saved to dac_test/rules
0 exception lists saved to /home/forteea1/Code/clean_mains/detection-rules/dac_test/exceptions
1 action connectors saved to /home/forteea1/Code/clean_mains/detection-rules/dac_test/action_connectors

Desired Solution

Desired solution would be to include the text output similarly to the export-rules command.

Considered Alternatives

No response

Additional Context

No response

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant