Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix kibana-upload and remove cumbersome dataclasses #216

Merged
merged 3 commits into from
Sep 1, 2020

Conversation

rw-access
Copy link
Contributor

Issues

Closes #121

Summary

dataclasses-json was silently dropping fields, and drifted from the JSON schemas. index wasn't included in the RuleResource class definition, the field was silently dropped. I removed the dataclasses-json approach, and just made RuleResource a subclass of dict instead. There is no validation in the schema, and I think that it's okay to make the client validate, since all of that code is there.

Here's the payload after the changes

[{'author': ['Rule export'], 'description': 'The contents of crontab have been modified by a non-root user.', 'tags': ['prod'], 'index': ['filebeat-*'], 'language': 'kuery', 'license': 'Elastic License', 'name': 'Cron - Crontab entry changed', 'risk_score': 15, 'rule_id': '7230e517-3f0f-4652-8c47-c2edd9b25d19', 'severity': 'low', 'type': 'query', 'query': 'event.module: cron and event.action: changed and not user.name: root', 'threat': [{'framework': 'MITRE ATT&CK', 'technique': [{'id': 'T1053', 'name': 'Scheduled Task', 'reference': 'https://attack.mitre.org/techniques/T1053/'}], 'tactic': {'id': 'TA0002', 'name': 'Execution', 'reference': 'https://attack.mitre.org/tactics/TA0002/'}}, {'framework': 'MITRE ATT&CK', 'technique': [{'id': 'T1053', 'name': 'Scheduled Task', 'reference': 'https://attack.mitre.org/techniques/T1053/'}], 'tactic': {'id': 'TA0003', 'name': 'Persistence', 'reference': 'https://attack.mitre.org/tactics/TA0003/'}}], 'version': 1, 'meta': {'original': {'id': '9bad9907-1969-4a70-bfbd-367f0dcc0203', 'creation_date': '2020/08/11', 'ecs_version': ['1.5.0'], 'maturity': 'development', 'updated_date': '2020/08/11'}}}]

@rw-access rw-access added the bug Something isn't working label Aug 24, 2020
@rw-access rw-access changed the title Fix kibana-upload and remove cumbersom dataclasses Fix kibana-upload and remove cumbersome dataclasses Aug 24, 2020
Copy link
Contributor

@brokensound77 brokensound77 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, LGTM if it tested fine 👍

@rw-access rw-access added the python Internal python for the repository label Aug 27, 2020
@rw-access rw-access merged commit 464d5e6 into elastic:main Sep 1, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working python Internal python for the repository
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Bug] Index information on the TOML files does not make it to Kibana SIEM rules
2 participants