Skip to content

[FR] Make rules/ directory configurable #1342

Closed
@rw-access

Description

@rw-access

related to #3298

Is your feature request related to a problem? Please describe.
If we could make the rules/ directory we could make this repository much more configurable, and allow our users and contributors to build their own set of rules, without having to deal with a messy fork. Instead, you could point python -m detection_rules at your own folder, which would contain a config, version lock and all of the TOML rules

Describe the solution you'd like
An environment variable is a good start, something like DETECTION_RULES_DIR=~/MyRules.toml. And we can move the version lock, packages.yml, etc. all inside that folder.

Describe alternatives you've considered

Additional context
Feature request for Git synchronization, which motivated this use case #362. When synchronizing, you could simply point to your own directory and everything would just magically sync from local <--> Kibana. We can detect conflicts as well.

Metadata

Metadata

Labels

enhancementNew feature or requestpythonInternal python for the repositorystale60 days of inactivity

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions