[7.x] [Security Solution][Detections] Adds Indicator path config for indicator match rules (#91260) #91593
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…tor match rules (elastic#91260) * Add new field for overriding threat indicator path There is no UI for this currently, nor is it used during rule execution. * Adds form field for indicator path parameter Also adds missing plumbing that was preventing the new field from being persisted to the alert/returned in the response. * Wire up our indicator path config to enrichment * Add unit test for enriching from a custom indicator path We always persist to `threat.indicator.*` on the signal, but this allows users to specify where the enrichment fields can be found on the matched indicator document. * Wire up the missing piece of our indicator path config We were not passing this from the rule itself into the threat matching logic, and so were merely getting the default value. An integration test will fix this. Incoming! * Move indicator path defaulting outside of helper functions This happens closer to where we pass data from the rule to our helpers, and will prevent errors/bugs due to defaulting logic down the road. It makes tests a little more verbose, but that's okay. * Fix remaining type errors around new rule field * Make threat indicator path a conditional field Always sending along this field, but only allowing it for threat match rules was implicitly breaking the workflow of otther rule types. By making the field conditional on the rule type, this field only impacts threat match rules. This also fixes some types and tests accordingly. Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backports the following commits to 7.x: