Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature: Suppression Expression Support (#2530) #2575

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

ejohn20
Copy link
Collaborator

@ejohn20 ejohn20 commented Nov 8, 2022

Pull request adds the features described in #2529

* Feature: Added GUID list and query suppression support

* Fixed bug: suppress options with guids type

* fixed bug in SuppressOptions with guids options

* Bug: Allowed using results-guids and expression arguments together.

* chore: typo in log message

* feat: console log number of suppressions applied

* bug: comma delimit results arg

* Fixed bug with ResultsGuids and added debug output

* fixed bug with ResultsGuids union to Query guids

* WIP - Added IsSuppressed evaluator and updated unit tests

* Fixed: Changes requested for #2530

* bug: validate result guid values are not whitespace

* bug: empty search suppresses all results

* bug: skip duplicate suppression entries

* bug: suppress visitor multiple test cases

* bug: fixed merge command unit test failure

* chore: formatting failures

* chore: codeql warnings

* chore: docs

* bug: suppression expiration no expiry logic flaw

* docs: release notes + query mode updates

* bug: fixed failing suppression test case

* feat: suppress expiryUtc command argument

* bug: reverted bad test data

Co-authored-by: Andrew Guggenberger <andrew.guggenberger@pumasecurity.io>
Co-authored-by: Andrew Guggenberger <aguggenberger@users.noreply.github.com>
@ejohn20 ejohn20 marked this pull request as draft November 9, 2022 03:05
@ejohn20
Copy link
Collaborator Author

ejohn20 commented Nov 9, 2022

@michaelcfanning Still working through a few modifications required due to the result guid changing from a string to a Guild?. I'll report back when this is stable.

@msandhaus
Copy link

@ejohn20 , any way to push this along? It seems the IsSuppressed option snuck into the docs anyhow. We were really hoping to use that as a filter.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants