Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Downgrade rule version before uploading to Kibana #97

Merged
merged 4 commits into from
Jul 28, 2020

Conversation

rw-access
Copy link
Contributor

Issues

Closes #96

Summary

Now that #84 is done, we can connect all the pieces together for kibana-upload.
Now, kibana-upload can work for 7.8 and 7.8 stacks. If we were to extend support further back, we just need to update schemas/v77.py accordingly.

There are still some other things to figure out for a bigger picture repository <--> Kibana workflow. But for now, this helps with the ad-hoc upload command.

Stdout

On error message (hard coded 7.7)

...
  File "/Users/rwolf/Development/detection-rules/detection_rules/eswrap.py", line 256, in kibana_upload
    payload = downgrade(payload, "7.7.0")
  File "/Users/rwolf/Development/detection-rules/detection_rules/schemas/__init__.py", line 40, in downgrade
    raise ValueError(f"Unable to downgrade from {CurrentSchema.STACK_VERSION} to {target_version_str}")
ValueError: Unable to downgrade from 7.9 to 7.7.0

On success

$ python -m detection_rules kibana-upload rules/aws/impact_iam_group_deletion.toml

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

Loading rules from detection-rules/rules
Loaded 1 rules
Successfully uploaded 1 rules

@rw-access rw-access added the enhancement New feature or request label Jul 27, 2020
@rw-access rw-access requested a review from brokensound77 July 27, 2020 21:16
@rw-access rw-access changed the title Enhancement/kibana downgrade Downgrade rule version before uploading to Kibana Jul 27, 2020
@brokensound77 brokensound77 added the cli command line tooling label Jul 28, 2020
Copy link
Contributor

@brokensound77 brokensound77 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This LGTM 👍 - with the 1 suggestion

This also still won't address rules from older schemas going to newer stacks where required fields may be missing, but this rolls into the bigger workflows you alluded to (can leverage rule.build to prompt for missing values) and can be addressed in a future PR

@@ -197,7 +197,7 @@ def set_param_values(ctx, param, value):
"""Get value for defined key."""
key = param.name
config = parse_config()
env_key = 'DR_' + key
env_key = 'DR_' + key.upper()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you update line 185 to siem

@rw-access rw-access merged commit 0455307 into elastic:main Jul 28, 2020
@rw-access rw-access deleted the enhancement/kibana-downgrade branch July 28, 2020 17:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cli command line tooling enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Rules should be downgraded before uploading to Kibana
2 participants