Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FR][DAC] further decouple reliance on default rule dir locations #3619

Closed
brokensound77 opened this issue Apr 26, 2024 · 2 comments · Fixed by #3654
Closed

[FR][DAC] further decouple reliance on default rule dir locations #3619

brokensound77 opened this issue Apr 26, 2024 · 2 comments · Fixed by #3654
Assignees
Labels
detections-as-code enhancement New feature or request

Comments

@brokensound77
Copy link
Collaborator

Note: this work will target the DAC-feature branch

related to #3407


These global constants:

DEFAULT_PREBUILT_RULES_DIR = Path(get_path("rules"))
DEFAULT_PREBUILT_BBR_DIR = Path(get_path("rules_building_block"))
DEFAULT_PREBUILT_DEPRECATED_DIR = DEFAULT_PREBUILT_RULES_DIR / '_deprecated'
DEFAULT_PREBUILT_RTA_DIR = get_path("rta")

Need to be revised to fully adopt the portable approach introduced by #3407 (using RULES_CONFIG.*).

However, the use of these variables is not consistently just for rule loading, and they have several hardcoded dependencies on them, so they cannot simply be replaced.

image
@eric-forte-elastic
Copy link
Collaborator

eric-forte-elastic commented May 7, 2024

Additional Considerations:

  • This PR should make BBR rules directories optional
  • In the config, we should have a separate path list for BBR rules dirs as they are handled differently
  • In the config, we should also have an RTA section (expected to be optional as well)
  • Need to update the current loading of rules to support a list of paths to be loaded, instead of one.
  • Need to update the example config generation to match the formatting specified from the above considerations.
  • Need to decide whether or not deprecated rules are optional and whether or not we should make this be a configurable directory location (as opposed to _deprecated relative to the rules directory.)

@eric-forte-elastic
Copy link
Collaborator

PR is merged, this issue is now complete.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
detections-as-code enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants