search

elastic / detection-rules

https://www.elastic.co/guide/en/security/current/detection-engine-overview.html
Other
1.96k stars 499 forks source link

[CLI] Add better support for nested structures #64

Open brokensound77 opened 4 years ago

brokensound77 commented 4 years ago

Describe the bug The create-rule prompt loop and rule build loop were initially built to support a flat schema, but as the schema has expanded and added nested objects, they can no longer support this. Additionally, the function to detect unneeded default fields is also prone to miss nested data as well.

We will need to refactor the full schema_prompt to be able to recursively prompt for nested data. There is a chance that there could be other pieces of code which also miss the nested structure of rules as well, and so we should review and refactor as needed.

Additional context @rw-access has some working code to move some of the prompt logic to within click, but we may need to expand nested support.

botelastic[bot] commented 3 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.