Skip to content

Add related_integrationsto post transform build process #2057

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
5 tasks done
Tracked by #2049
Mikaayenson opened this issue Jun 27, 2022 · 0 comments · Fixed by #2060
Closed
5 tasks done
Tracked by #2049

Add related_integrationsto post transform build process #2057

Mikaayenson opened this issue Jun 27, 2022 · 0 comments · Fixed by #2060
Assignees
Labels
python Internal python for the repository v8.4.0

Comments

@Mikaayenson
Copy link
Contributor

Mikaayenson commented Jun 27, 2022

  • Make _post_dict_transform a class object
  • Make sure we reference Package Version so may need to remove static method
  • Build and test to make sure fields are added on runtime.
  • Check integrations based on packages manifest
  • Get integrations from event query information
import requests
import yaml

def is_packaged_integration(integration_name: str) -> bool:
    response = requests.get(f"[https://raw.githubusercontent.com/elastic/integrations/main/packages/{integration_name}/manifest.yml](https://raw.githubusercontent.com/elastic/integrations/main/packages/%7Bintegration_name%7D/manifest.yml)")
    manifest = yaml.safe_load(response.content)

    # has multiple integrations in the package
    return len(manifest.get("policy_templates")) > 1


for index in indices:
    if not index.startswith('logs-'):
        continue
    _, full_name, _ = index.lsplit('-', 1)
    integration, _ = full_name.lsplit('.*-', 1)
    if parsed in EXCLUSIONS:
        continue
    return integration


 fields = get_unique_query_fields(rule)
  if fields:
      indices = rule.contents.data.index
      if not any("logs-" in index for index in indices):
          print(f"Skipping rule: '{rule.name}', that doesn't include integrations")
          continue

Additional Context

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
python Internal python for the repository v8.4.0
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants