Skip to content

Push Latest Rules to Elastic Security Space #20

Push Latest Rules to Elastic Security Space

Push Latest Rules to Elastic Security Space #20

name: Push Latest Rules to Elastic Security Space
on:
push:
branches:
- DAC-feature
paths:
- '**/*.toml'
workflow_dispatch:
inputs:
overwrite:
description: 'Overwrite existing rules'
required: false
default: 'true'
overwrite_exceptions:
description: 'Overwrite existing exceptions'
required: false
default: 'true'
overwrite_action_connectors:
description: 'Overwrite existing action connectors'
required: false
default: 'true'
space:
description: 'Kibana space to use (dev or prod)'
required: false
default: 'prod'
jobs:
sync-to-production:
runs-on: ubuntu-latest
env:
CUSTOM_RULES_DIR: ${{ secrets.CUSTOM_RULES_DIR }}
steps:
- name: Checkout Repository
uses: actions/checkout@v4
- name: Set up Python 3.12
uses: actions/setup-python@v2
with:
python-version: '3.12'
- name: Install Dependencies
run: |
python -m pip install --upgrade pip
pip cache purge
pip install .[dev]
- name: Import Rules to Kibana
run: |
FLAGS=""
if [[ "${{ github.event_name }}" == "push" || "${{ inputs.overwrite }}" == "true" ]]; then
FLAGS="$FLAGS --overwrite"
fi
if [[ "${{ github.event_name }}" == "push" || "${{ inputs.overwrite_exceptions }}" == "true" ]]; then
FLAGS="$FLAGS --overwrite-exceptions"
fi
if [[ "${{ github.event_name }}" == "push" || "${{ inputs.overwrite_action_connectors }}" == "true" ]]; then
FLAGS="$FLAGS --overwrite-action-connectors"
fi
if [[ "${{ github.event_name }}" == "push" ]]; then
SPACE="prod" # Default to production for push events
elif [[ "${{ inputs.space }}" == "dev" || "${{ inputs.space }}" == "prod" ]]; then
SPACE="${{ inputs.space }}" # Use provided space if valid
else
echo "::error::Invalid space provided. Defaulting to 'dev'."
SPACE="dev"
fi
SPACE_FLAG="--space $SPACE"
python -m detection_rules kibana $SPACE_FLAG import-rules $FLAGS
env:
DR_CLOUD_ID: ${{ secrets.ELASTIC_CLOUD_ID }}
DR_KIBANA_USER: ${{ secrets.ELASTIC_USERNAME }}
DR_KIBANA_PASSWORD: ${{ secrets.ELASTIC_PASSWORD }}