You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
Recently, I have been working with detection_rules CLI tool and different versions of ES stack.
It became a struggle to me to realize that rules change upon versions (as rule schemas change), and that main branch does not work for everything ever (which makes sense).
Yet, I needed to use mainly 7.12.1 version and also other stuff from other versions to get going with my work. But this needed me to joggle between tags and branches.
Describe the solution you'd like
What I did in my organization to tackle this issue was to create a Dockerfile and use a Github Worfklow to git checkout between tags and create Images for all versions supported.
Then I could call any detection_rules version with : docker run -ti detection_rules:7.12.1 kibana upload-rules ... (for 7.12.1) and work with the project without needing to handle git refs all the time.
Bonus 1: Now all security team can use the CLI tool without setting up Python3.8, or switch venvs.
Bonus 2: Images can be used in CI/CD for rule uploads without setting up Python3.8 to CI/CD workers.
Describe alternatives you've considered
There was no developed alternative, but what I was doing was to checkout to a git tag, pick a homemade commit that was fixing #634, and then run the detection_rules CLI. Then go to a different tag and do that again.
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem? Please describe.
Recently, I have been working with
detection_rules
CLI tool and different versions of ES stack.It became a struggle to me to realize that rules change upon versions (as rule schemas change), and that
main
branch does not work for everything ever (which makes sense).Yet, I needed to use mainly
7.12.1
version and also other stuff from other versions to get going with my work. But this needed me to joggle betweentags
andbranches
.Describe the solution you'd like
What I did in my organization to tackle this issue was to create a
Dockerfile
and use a Github Worfklow togit checkout
betweentags
and create Images for all versions supported.Then I could call any
detection_rules
version with :docker run -ti detection_rules:7.12.1 kibana upload-rules ...
(for7.12.1
) and work with the project without needing to handlegit
refs all the time.Bonus 1: Now all security team can use the CLI tool without setting up Python3.8, or switch
venvs
.Bonus 2: Images can be used in CI/CD for rule uploads without setting up Python3.8 to CI/CD workers.
Describe alternatives you've considered
There was no developed alternative, but what I was doing was to checkout to a git tag, pick a homemade commit that was fixing #634, and then run the
detection_rules
CLI. Then go to a different tag and do that again.The text was updated successfully, but these errors were encountered: