Description
related to #3298
Is your feature request related to a problem? Please describe.
If we could make the rules/
directory we could make this repository much more configurable, and allow our users and contributors to build their own set of rules, without having to deal with a messy fork. Instead, you could point python -m detection_rules
at your own folder, which would contain a config, version lock and all of the TOML rules
Describe the solution you'd like
An environment variable is a good start, something like DETECTION_RULES_DIR=~/MyRules.toml
. And we can move the version lock, packages.yml, etc. all inside that folder.
Describe alternatives you've considered
Additional context
Feature request for Git synchronization, which motivated this use case #362. When synchronizing, you could simply point to your own directory and everything would just magically sync from local <--> Kibana. We can detect conflicts as well.