Skip to content

[FR] [DAC] Add index_or_dataview Property #3857

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jul 10, 2024
Merged

[FR] [DAC] Add index_or_dataview Property #3857

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
61f11a6
Add index_or_dataview property
eric-forte-elastic Jul 1, 2024
6a99c6b
Add empty list return if neither index or dataview
eric-forte-elastic Jul 9, 2024
768da40
update for index and dataview may not exist
eric-forte-elastic Jul 9, 2024
0239e35
Bugfix
eric-forte-elastic Jul 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion detection_rules/packaging.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ def filter_rule(rule: TOMLRule, config_filter: dict, exclude_fields: Optional[di
unique_fields = get_unique_query_fields(rule)

for index, fields in exclude_fields.items():
if unique_fields and (rule.contents.data.index == index or index == 'any'):
if unique_fields and (rule.contents.data.index_or_dataview == index or index == 'any'):
if set(unique_fields) & set(fields):
return False

Expand Down
10 changes: 10 additions & 0 deletions detection_rules/rule.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -700,6 +700,16 @@ class QueryRuleData(BaseRuleData):
language: definitions.FilterLanguages
alert_suppression: Optional[AlertSuppressionMapping] = field(metadata=dict(metadata=dict(min_compat="8.8")))

@cached_property
def index_or_dataview(self) -> list[str]:
"""Return the index or dataview depending on which is set. If neither returns empty list."""
if self.index is not None:
return self.index
elif self.dataview is not None:
Copy link
Contributor

@Mikaayenson Mikaayenson Jul 11, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be self.data_view_id.

return [self.dataview]
else:
return []

@cached_property
def validator(self) -> Optional[QueryValidator]:
if self.language == "kuery":
Expand Down
18 changes: 9 additions & 9 deletions detection_rules/rule_validators.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,7 @@ def validate_stack_combos(self, data: QueryRuleData, meta: RuleMeta) -> Union[KQ
ecs_version = mapping['ecs']
err_trailer = f'stack: {stack_version}, beats: {beats_version}, ecs: {ecs_version}'

beat_types, beat_schema, schema = self.get_beats_schema(data.index or [],
beat_types, beat_schema, schema = self.get_beats_schema(data.index_or_dataview,
beats_version, ecs_version)

try:
Expand Down Expand Up @@ -195,12 +195,12 @@ def validate_integration(
stack_version = integration_schema_data["stack_version"]

# Add non-ecs-schema fields
for index_name in data.index:
for index_name in data.index_or_dataview:
integration_schema.update(**ecs.flatten(ecs.get_index_schema(index_name)))

# Add custom schema fields for appropriate stack version
if data.index and CUSTOM_RULES_DIR:
for index_name in data.index:
for index_name in data.index_or_dataview:
integration_schema.update(**ecs.flatten(ecs.get_custom_index_schema(index_name, stack_version)))

# Add endpoint schema fields for multi-line fields
Expand Down Expand Up @@ -338,9 +338,9 @@ def validate_stack_combos(self, data: QueryRuleData, meta: RuleMeta) -> Union[EQ
err_trailer = f'stack: {stack_version}, beats: {beats_version},' \
f'ecs: {ecs_version}, endgame: {endgame_version}'

beat_types, beat_schema, schema = self.get_beats_schema(data.index or [],
beat_types, beat_schema, schema = self.get_beats_schema(data.index_or_dataview,
beats_version, ecs_version)
endgame_schema = self.get_endgame_schema(data.index or [], endgame_version)
endgame_schema = self.get_endgame_schema(data.index_or_dataview, endgame_version)
eql_schema = ecs.KqlSchema2Eql(schema)

# validate query against the beats and eql schema
Expand Down Expand Up @@ -389,13 +389,13 @@ def validate_integration(self, data: QueryRuleData, meta: RuleMeta,
stack_version = integration_schema_data["stack_version"]

# add non-ecs-schema fields for edge cases not added to the integration
if data.index:
for index_name in data.index:
if data.index_or_dataview:
for index_name in data.index_or_dataview:
integration_schema.update(**ecs.flatten(ecs.get_index_schema(index_name)))

# Add custom schema fields for appropriate stack version
if data.index and CUSTOM_RULES_DIR:
for index_name in data.index:
if data.index_or_dataview and CUSTOM_RULES_DIR:
for index_name in data.index_or_dataview:
integration_schema.update(**ecs.flatten(ecs.get_custom_index_schema(index_name, stack_version)))

# add endpoint schema fields for multi-line fields
Expand Down