Skip to content

[Meta] Refactor Rule Create and Importer Logic #3557

Open
@Mikaayenson

Description

@Mikaayenson

Parent Epic (If Applicable)

https://github.com/elastic/security-team/issues/8718

Meta Summary

The create-rule and import-rule CLI commands both use the rule_prompt method. It currently interactively will prompt for any fields missing.

  • The core method rule_prompt should be refactored to handle nested methods.
  • Ideally prompt is one option or fields of the rule schema can by supplied as well by command line.
  • Create and import should be able to handle all rule types and features that we support.
  • Users should be able to import optional fields but also skip the prompt on fields not provided.

Estimated Time to Complete

1 - 2 sprints

Potential Blockers

None

Tasklist

### Meta Tasks
- [ ] Provide Week 1 Update Comment
- [ ] Provide Week 2 Update or Closeout Comment
- [ ] Refactor `rule_prompt` to handle the requirements mentioned above.
- [ ] Provide test cases for each rule type and features. 
- [ ] Test all rule types supported can be exported from Elastic Security as an ndjson and imported all at once.

Resources / References

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions