elastic / detection-rules

https://www.elastic.co/guide/en/security/current/detection-engine-overview.html
Other
1.92k stars 492 forks source link

[FR][DAC] Import Rules Verbose Message #4093

Open eric-forte-elastic opened 2 weeks ago

eric-forte-elastic commented 2 weeks ago

Pull Request

Issue link(s):

Updated the return results from importing rules to include the ids of the action connectors and exceptions to better match the export rules output.

Example:

detection-rules on  4092-fr-dac-add-exceptions-list-and-action-connector-text-to-import-rules-logging-messages [$!?] is  v0.1.0 via  v3.12.6 (detection-rules-build) on  eric.forte took 1m25s 
❯ python -m detection_rules kibana import-rules -o -id 3ea1fa0a-0a25-4043-b23e-450e1e9c5730 -id 749ac911-16fd-406c-b1d1-d16b69322cbb -id fbdbcb5f-1e75-4931-92b2-aedc830c9b8e -id 804d56c3-18bd-4e92-81f4-0c4f08af6e24
Loaded config file: /home/forteea1/Code/clean_mains/detection-rules/.detection-rules-cfg.json

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

4 rule(s) successfully imported
 - 3ea1fa0a-0a25-4043-b23e-450e1e9c5730
 - 749ac911-16fd-406c-b1d1-d16b69322cbb
 - 804d56c3-18bd-4e92-81f4-0c4f08af6e24
 - fbdbcb5f-1e75-4931-92b2-aedc830c9b8e
4 exception list(s) successfully imported
 - a463ba9e-8aa5-4722-85da-035a99b96814
 - 03f3f2f8-25bc-479b-8e2f-9aa73d3678da
 - 575d5295-c0ab-47f6-8baf-929d7de44de6
 - 2c765d59-1a3e-4a10-8eb1-4b18f817f57c
2 action connector(s) successfully imported
 - d5df3bd0-4d62-491f-8159-7b25f2455e55
 - 5f43ffdf-78ca-4974-b1e8-8ddc7b3dd52a

How To Test

To test try importing rules with the kibana import-rules command with rules that also have actions connectors and exceptions list (remember to use the -e and -ac flags to include these).

Checklist

Contributor checklist

protectionsmachine commented 1 week ago

Enhancement - Guidelines

These guidelines serve as a reminder set of considerations when addressing adding a feature to the code.

Documentation and Context

Code Standards and Practices

Testing

Additional Checks