-
Notifications
You must be signed in to change notification settings - Fork 70
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add kibana/security-rule asset type #142
Conversation
💚 Build Succeeded
Expand to view the summary
Build stats
Trends 🧪 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please make sure that the PR passes the CI verification. Quick check:
make update && make check && make test
@@ -65,3 +65,25 @@ | |||
type: file | |||
contentMediaType: "application/json" | |||
pattern: '^.+\.json$' | |||
- description: Folder containing rules |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please create a sample package and add it to the test/packages
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I added this asset to test/packages/good
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Unless this should be its own test package
@rw-access Are rules and timeline tied together? Could a user just ship a rule or just a timeline? |
@rw-access Could you add a sample package for testing this? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For later: Should we do on the package side an validation of the rules file?
@ycombinator do we apply some automatic formatting to it?
versions/1/kibana/spec.yml
Outdated
- description: An individual rule file for the detection engine | ||
type: file | ||
contentMediaType: "application/json" | ||
pattern: '^rule-.+\.json$' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is the rule
prefix in the name required?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
no, I can loosen this to just *.json
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just ^.+\.json$
as of ba23706
The package spec does allow for defining the structure of file contents but we have deliberately not specified structures for other Kibana saved objects like dashboards, etc. because we're treating those as Kibana implementation details (at least for the moment). The only basic validation is that the files match a certain mime type and are (potentially) named a certain way, both of which are being done in this PR.
Automatic formatting to the JSON files? Yes, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM.
cc @FrankHassanabad, @spong, @brokensound77, @kevinlog
What does this PR do?
security-rule
asset type for rules that will be delivered to Security » Detection Engine » Detection rules part of Kibana.Why is it important?
This is a dependency for:
Checklist
Note: I haven't added a test package yet, because I'm expecting requested changes. Once we converge on the spec, I think it makes sense to add a test package.
test/packages
that prove my change is effective.versions/N/changelog.yml
.Related issues
No related public issues, just these PRs