Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FR] [DAC] Add support for Kibana spaces with names that do not match identifiers #4208

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

eric-forte-elastic
Copy link
Contributor

@eric-forte-elastic eric-forte-elastic commented Oct 24, 2024

Pull Request

Issue link(s):

#4207

Summary - What I changed

When using the Kibana bulk actions API for DaC features with non-default spaces, the API call needs to use the identifier to correctly specify the correct space to push/pull rules from. However, the check to determine whether or not a space exists is done with the name rather than the identifier.

This PR updates the Kibana space id to be what is checked when determining if the space exists.

See the Kibana API Docs for an example return of what this code is parsing to see that both id and name are provided.

How To Test

  1. Setup a DAC environement including a test rule.
  2. Trying exporting rules using the Kibana export-rules CLI command for a Kibana space where the name does not match the id.

E.g.

python -m detection_rules kibana --space Test-space --ignore-ssl-errors true import-rules -o

image

If the import is successful, then the fix is successfully applied.

Checklist

  • Added a label for the type of pr: bug, enhancement, schema, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
  • Added the meta:rapid-merge label if planning to merge within 24 hours
  • Secret and sensitive material has been managed correctly
  • Automated testing was updated or added to match the most common scenarios
  • Documentation and comments were added for features that require explanation

Contributor checklist

@protectionsmachine
Copy link
Collaborator

Enhancement - Guidelines

These guidelines serve as a reminder set of considerations when addressing adding a feature to the code.

Documentation and Context

  • Describe the feature enhancement in detail (alternative solutions, description of the solution, etc.) if not already documented in an issue.
  • Include additional context or screenshots.
  • Ensure the enhancement includes necessary updates to the documentation and versioning.

Code Standards and Practices

  • Code follows established design patterns within the repo and avoids duplication.
  • Code changes do not introduce new warnings or errors.
  • Variables and functions are well-named and descriptive.
  • Any unnecessary / commented-out code is removed.
  • Ensure that the code is modular and reusable where applicable.
  • Check for proper exception handling and messaging.

Testing

  • New unit tests have been added to cover the enhancement.
  • Existing unit tests have been updated to reflect the changes.
  • Provide evidence of testing and validating the enhancement (e.g., test logs, screenshots).
  • Validate that any rules affected by the enhancement are correctly updated.
  • Ensure that performance is not negatively impacted by the changes.
  • Verify that any release artifacts are properly generated and tested.

Additional Checks

  • Ensure that the enhancement does not break existing functionality.
  • Review the enhancement with a peer or team member for additional insights.
  • Verify that the enhancement works across all relevant environments (e.g., different OS versions).
  • Confirm that all dependencies are up-to-date and compatible with the changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport: auto detections-as-code enhancement New feature or request kibana-module related to the kibana module meta:rapid-merge python Internal python for the repository
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[FR] [DAC] Add support for Kibana spaces with names that do not match identifiers
4 participants