This PR adds support for creating nested directories for the automatic schema generation schema file. Previously it would not created nested directories.
How To Test
To test this, first add the appropriate config variable. Also make sure that this variable used a nested directory that does not already exist. E.g. auto_gen_schema_file: "etc/schemas/auto_gen.json" where schemas does not already exist. Also make sure your stack-schema-map.yaml does not already have any custom schemas supplied (or at least not any that have the fields in the test rule). Next, run view-rule on a rule that has fields that are not currently present in a schema. The rule should validate successfully and your schema file should be updated, and the directory should be created.
```toml
[metadata]
creation_date = "2024/07/29"
maturity = "production"
updated_date = "2024/07/29"
[rule]
actions = []
author = ["DAC User"]
description = "Test Rule"
enabled = true
exceptions_list = []
false_positives = []
from = "now-6m"
index = ["the-best-integration-ever*"]
interval = "5m"
language = "eql"
max_signals = 100
name = "DAC Demo Dev Rule 1"
references = []
risk_score = 47
risk_score_mapping = []
rule_id = "794d2fc0-ecd0-4963-99da-fd587666b80d"
setup = "Test Setup"
severity = "medium"
severity_mapping = []
tags = []
threat = []
to = "now"
type = "eql"
query = '''
process where host.os.type.fakeData == "linux" and process.name.okta.thread == "updated"
'''
[[rule.related_integrations]]
package = "endpoint"
version = "^8.2.0"
[[rule.required_fields]]
ecs = true
name = "host.os.type"
type = "keyword"
[[rule.required_fields]]
ecs = true
name = "process.name"
type = "keyword"
```
Checklist
[ ] Added a label for the type of pr: bug, enhancement, schema, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
[ ] Added the meta:rapid-merge label if planning to merge within 24 hours
[ ] Secret and sensitive material has been managed correctly
[ ] Automated testing was updated or added to match the most common scenarios
[ ] Documentation and comments were added for features that require explanation
Pull Request
Issue link(s):
Summary - What I changed
This PR adds support for creating nested directories for the automatic schema generation schema file. Previously it would not created nested directories.
How To Test
To test this, first add the appropriate config variable. Also make sure that this variable used a nested directory that does not already exist. E.g.
auto_gen_schema_file: "etc/schemas/auto_gen.json"
where schemas does not already exist. Also make sure yourstack-schema-map.yaml
does not already have any custom schemas supplied (or at least not any that have the fields in the test rule). Next, run view-rule on a rule that has fields that are not currently present in a schema. The rule should validate successfully and your schema file should be updated, and the directory should be created.Example:
python -m detection_rules view-rule custom_rules/rules/dac_demo_dev_rule_1.toml
Details
```toml [metadata] creation_date = "2024/07/29" maturity = "production" updated_date = "2024/07/29" [rule] actions = [] author = ["DAC User"] description = "Test Rule" enabled = true exceptions_list = [] false_positives = [] from = "now-6m" index = ["the-best-integration-ever*"] interval = "5m" language = "eql" max_signals = 100 name = "DAC Demo Dev Rule 1" references = [] risk_score = 47 risk_score_mapping = [] rule_id = "794d2fc0-ecd0-4963-99da-fd587666b80d" setup = "Test Setup" severity = "medium" severity_mapping = [] tags = [] threat = [] to = "now" type = "eql" query = ''' process where host.os.type.fakeData == "linux" and process.name.okta.thread == "updated" ''' [[rule.related_integrations]] package = "endpoint" version = "^8.2.0" [[rule.required_fields]] ecs = true name = "host.os.type" type = "keyword" [[rule.required_fields]] ecs = true name = "process.name" type = "keyword" ```
Checklist
bug
,enhancement
,schema
,Rule: New
,Rule: Deprecation
,Rule: Tuning
,Hunt: New
, orHunt: Tuning
so guidelines can be generatedmeta:rapid-merge
label if planning to merge within 24 hoursContributor checklist