Split rule type format to show explicit ingestion and evaluation #758
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
yrobla
previously approved these changes
Aug 25, 2023
JAORMX
changed the title
This makes it a little bit more explicit what parts of the rule configures what functionality. Hopefully making the rules less confusing.
This refactors the functionality from ingestors and evaluators, thus making the code easier to track and more testable. It also implements the protobuf changes.
This makes sure that our error messages print out the assertion that didn't match.
This actually is handy
JAORMX
force-pushed
the
rule-format-split
branch
from
decf1ad
to
2e9ef9c
Compare
JAORMX
changed the title
lukehinds
approved these changes
Aug 25, 2023
jhrozek
approved these changes
Aug 27, 2023
| @@ -17,8 +17,8 @@ def: | |||
| enabled: | |||
| type: boolean | |||
| default: true | |||
| # Defines the configuration for both ingesting and evaluating the rule. | |||
| data_eval: | |||
There was a problem hiding this comment.
Could you also fix the example of the rule_type in docs/docs/manage_policies.md? I wonder if the doc should instead just have an URL that points to an in-tree example rather than an embedded one to decrease the maintenance load.
This can be done in a separate PR, just should be done to avoid people being irritated by outdated docs.
There was a problem hiding this comment.
Thanks for the reminder! I'll do that in another PR.
JAORMX
added a commit
that referenced
this pull request
Aug 28, 2023
Now that #758 merged, we need to update the docs to reflect the new rule type syntax.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This makes it a little bit more explicit what parts of the rule configures what functionality. Hopefully, making the rules less confusing.
Now that we've separated the rule as we have, I've also separated the code which also makes it easier to test!