Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[FR][DAC] Consideration: expose kql parse parameters for custom rules validation #3624

Open
brokensound77 opened this issue Apr 27, 2024 · 2 comments · May be fixed by #3816
Open

[FR][DAC] Consideration: expose kql parse parameters for custom rules validation #3624

brokensound77 opened this issue Apr 27, 2024 · 2 comments · May be fixed by #3816
Assignees
@eric-forte-elastic
Labels
backlog detections-as-code enhancement New feature or request

Comments

@brokensound77
Copy link
Collaborator

brokensound77 commented Apr 27, 2024 •
edited
Loading

Note: this work will target the DAC-feature branch

related to #3407

This is a consideration and not a commitment to work at this point. We should review the feasibility and supportability. If it is doable and not deemed maintainable, we can move the example code to the DAC reference for users to manually implement.

Based on #3568, I will look at allowing normalization on KQL queries for custom rules and exposed in the config. (This allows uppercase operators)

#3407 (comment)
This was referenced Apr 27, 2024
Merged
Open
@Mikaayenson Mikaayenson changed the title [FR][DAC] Consideration: expose kql parse paremeters for custom rules validation [FR][DAC] Consideration: expose kql parse parameters for custom rules validation May 15, 2024
@eric-forte-elastic
Copy link
Collaborator

I think this is a result of the reversion of #3574. I think we just need a small PR to on the setting of a custom rule directory, set the normalization flag to be true instead of false.

@eric-forte-elastic eric-forte-elastic linked a pull request Jun 21, 2024 that will close this issue
Open
@eric-forte-elastic eric-forte-elastic linked a pull request Jun 21, 2024 that will close this issue
[FR] [DAC] Update default KQL parsing behavior to normalize keywords for custom rule directories. #3816
Open
@brokensound77
Copy link
Collaborator Author

upon further consideration and observations of how this should be leveraged, I don't think it should be default, but a config parameter. Noted in PR

@eric-forte-elastic eric-forte-elastic self-assigned this Jun 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@eric-forte-elastic eric-forte-elastic

Labels
backlog detections-as-code enhancement New feature or request
Projects
None yet
Milestone
No milestone
3 participants
@Mikaayenson @brokensound77 @eric-forte-elastic