Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FR][DAC] Import Rules Verbose Message #4093

Conversation

eric-forte-elastic
Copy link
Contributor

@eric-forte-elastic eric-forte-elastic commented Sep 20, 2024

Pull Request

Issue link(s):

Summary - What I changed

Updated the return results from importing rules to include the ids of the action connectors and exceptions to better match the export rules output.

Example:

detection-rules on  4092-fr-dac-add-exceptions-list-and-action-connector-text-to-import-rules-logging-messages [$!?] is  v0.1.0 via  v3.12.6 (detection-rules-build) on  eric.forte took 1m25s 
❯ python -m detection_rules kibana import-rules -o -id 3ea1fa0a-0a25-4043-b23e-450e1e9c5730 -id 749ac911-16fd-406c-b1d1-d16b69322cbb -id fbdbcb5f-1e75-4931-92b2-aedc830c9b8e -id 804d56c3-18bd-4e92-81f4-0c4f08af6e24
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

4 rule(s) successfully imported
 - 3ea1fa0a-0a25-4043-b23e-450e1e9c5730
 - 749ac911-16fd-406c-b1d1-d16b69322cbb
 - 804d56c3-18bd-4e92-81f4-0c4f08af6e24
 - fbdbcb5f-1e75-4931-92b2-aedc830c9b8e
4 exception list(s) successfully imported
 - a463ba9e-8aa5-4722-85da-035a99b96814
 - 03f3f2f8-25bc-479b-8e2f-9aa73d3678da
 - 575d5295-c0ab-47f6-8baf-929d7de44de6
 - 2c765d59-1a3e-4a10-8eb1-4b18f817f57c
2 action connector(s) successfully imported
 - d5df3bd0-4d62-491f-8159-7b25f2455e55
 - 5f43ffdf-78ca-4974-b1e8-8ddc7b3dd52a

How To Test

To test try importing rules with the kibana import-rules command with rules that also have actions connectors and exceptions list (remember to use the -e and -ac flags to include these).

Checklist

  • Added a label for the type of pr: bug, enhancement, schema, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated

Contributor checklist

@eric-forte-elastic eric-forte-elastic added enhancement New feature or request python Internal python for the repository detections-as-code labels Sep 25, 2024
@protectionsmachine
Copy link
Collaborator

Enhancement - Guidelines

These guidelines serve as a reminder set of considerations when addressing adding a feature to the code.

Documentation and Context

  • Describe the feature enhancement in detail (alternative solutions, description of the solution, etc.) if not already documented in an issue.
  • Include additional context or screenshots.
  • Ensure the enhancement includes necessary updates to the documentation and versioning.

Code Standards and Practices

  • Code follows established design patterns within the repo and avoids duplication.
  • Code changes do not introduce new warnings or errors.
  • Variables and functions are well-named and descriptive.
  • Any unnecessary / commented-out code is removed.
  • Ensure that the code is modular and reusable where applicable.
  • Check for proper exception handling and messaging.

Testing

  • New unit tests have been added to cover the enhancement.
  • Existing unit tests have been updated to reflect the changes.
  • Provide evidence of testing and validating the enhancement (e.g., test logs, screenshots).
  • Validate that any rules affected by the enhancement are correctly updated.
  • Ensure that performance is not negatively impacted by the changes.
  • Verify that any release artifacts are properly generated and tested.

Additional Checks

  • Ensure that the enhancement does not break existing functionality.
  • Review the enhancement with a peer or team member for additional insights.
  • Verify that the enhancement works across all relevant environments (e.g., different OS versions).
  • Confirm that all dependencies are up-to-date and compatible with the changes.

…onnector-text-to-import-rules-logging-messages
…onnector-text-to-import-rules-logging-messages
Copy link
Contributor

@Mikaayenson Mikaayenson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: I would refactor the handle_response_errors method for readability. For example, moving both of these inner functions to the top of handle_response_errorsfunction.

detection_rules/kbwrap.py Outdated Show resolved Hide resolved
@eric-forte-elastic eric-forte-elastic merged commit 4edef2e into main Oct 9, 2024
9 checks passed
@eric-forte-elastic eric-forte-elastic deleted the 4092-fr-dac-add-exceptions-list-and-action-connector-text-to-import-rules-logging-messages branch October 9, 2024 21:20
protectionsmachine pushed a commit that referenced this pull request Oct 9, 2024
* Draft Verbose Message

* Fix Linting

* Made more descriptive

* Updated for readability

(cherry picked from commit 4edef2e)
protectionsmachine pushed a commit that referenced this pull request Oct 9, 2024
* Draft Verbose Message

* Fix Linting

* Made more descriptive

* Updated for readability

(cherry picked from commit 4edef2e)
protectionsmachine pushed a commit that referenced this pull request Oct 9, 2024
* Draft Verbose Message

* Fix Linting

* Made more descriptive

* Updated for readability

(cherry picked from commit 4edef2e)
protectionsmachine pushed a commit that referenced this pull request Oct 9, 2024
* Draft Verbose Message

* Fix Linting

* Made more descriptive

* Updated for readability

(cherry picked from commit 4edef2e)
protectionsmachine pushed a commit that referenced this pull request Oct 9, 2024
* Draft Verbose Message

* Fix Linting

* Made more descriptive

* Updated for readability

(cherry picked from commit 4edef2e)
protectionsmachine pushed a commit that referenced this pull request Oct 9, 2024
* Draft Verbose Message

* Fix Linting

* Made more descriptive

* Updated for readability

(cherry picked from commit 4edef2e)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport: auto detections-as-code enhancement New feature or request python Internal python for the repository
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[FR] [DAC] Add exceptions list and action connector text to import-rules logging messages
4 participants