elastic / detection-rules

Home Page:https://www.elastic.co/guide/en/security/current/detection-engine-overview.html

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

[FR] Decouple `RuleCollection` to abstract out a generic rule `dict` loader vs loading full `Rule` objects

brokensound77 opened this issue · comments

Essentially, this would allow loading rules purely into their raw form, without the loading and translation. The problem this presents, is that rules in their TOML form are dependent on some conversions before getting the rule into final format. That means it is impossible (or highly discouraged) to go from TOML rule -> dict directly (without loading first into Rule).

This means the 2 supported ways to do this are:

A: load json/ndjson files containing rules already in final form

This is what this issue aims to do - create a generic loading of these files.

B: use the existing RuleCollection and bypass validation

This would be dependent on changes from #3407, which allows for bypassing validation for all, or per query. This would be the only way to properly load TOML rules into objects and into final dict form, since, even though it bypasses validation, it still performs the necessary conversions (and build time fields).