From 111b881503467dd39d943a4e725dfaa1db417849 Mon Sep 17 00:00:00 2001
From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Date: Fri, 23 Feb 2024 16:50:33 -0500
Subject: [PATCH] [Bug] Fix URL links in autogenerated security docs (#3474)

* added content() class method for guide and setup

* removed non-existent variable

* removed unnecessary newlines

* adjusted levels for titles

* reverting changes

* added method to convert markdown links to asciidoc

* adjusted regex to include trailing periods

* fixing linting errors

* adjusted regex pattern

* added content() class method for guide and setup

* stripped # out of investigation guide, setup or note

* adjusted formatting outcome

* changed function call

* fixed linting errors

* fixing auto-formatting for rule asciidoc

* fixing URL link removal

* fixing URL link removal

* removed strip() from string for setup

* fixed linting errors

* fixed linting errors

* adjusting code formatting for convert_markdown_to_asciidoc

(cherry picked from commit 8e0ca421cae63851368b4acfcae4f1fb68ec5982)
---
 detection_rules/docs.py | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/detection_rules/docs.py b/detection_rules/docs.py
index 47575a2e5..b9e5dbf13 100644
--- a/detection_rules/docs.py
+++ b/detection_rules/docs.py
@@ -531,11 +531,6 @@ class IntegrationRuleDetail:
         self.package = package_str
         self.rule_title = f'prebuilt-rule-{self.package}-{name_to_title(self.rule["name"])}'
 
-        # NOTE: This pattern is used to replace markdown links with asciidoc compatible links
-        # upstream in security-docs repo where CI checks fail if markdown links are used
-        self.elastic_hyperlink_pattern = \
-            r'\[.*?\]\(((?:https://(?:www\.)?elastic\.co|https://docs\.elastic\.co)/.*?)\)'
-
         # set some defaults
         self.rule.setdefault('max_signals', 100)
         self.rule.setdefault('interval', '5m')
@@ -598,13 +593,13 @@ class IntegrationRuleDetail:
 
     def guide_str(self) -> str:
         """Add the guide section to the rule detail page."""
-        guide = re.sub(self.elastic_hyperlink_pattern, r'\1', self.rule['note'])
-        return f'{AsciiDoc.title(4, "Investigation guide")}\n\n\n{AsciiDoc.code(guide, code="markdown")}'
+        guide = convert_markdown_to_asciidoc(self.rule['note'])
+        return f'{AsciiDoc.title(4, "Investigation guide")}\n\n\n{guide}'
 
     def setup_str(self) -> str:
         """Add the setup section to the rule detail page."""
-        setup = re.sub(self.elastic_hyperlink_pattern, r'\1', self.rule['setup'])
-        return f'{AsciiDoc.title(4, "Setup")}\n\n\n{AsciiDoc.code(setup, code="markdown")}'
+        setup = convert_markdown_to_asciidoc(self.rule['setup'])
+        return f'{AsciiDoc.title(4, "Setup")}\n\n\n{setup}'
 
     def query_str(self) -> str:
         """Add the query section to the rule detail page."""
@@ -652,6 +647,20 @@ def name_to_title(name: str) -> str:
     return re.sub(r'-{2,}', '-', initial).strip('-')
 
 
+def convert_markdown_to_asciidoc(text: str) -> str:
+    """Convert investigation guides and setup content from markdown to asciidoc."""
+
+    # Format the content after the stripped headers (#) to bold text with newlines.
+    markdown_header_pattern = re.compile(r'^(#+)\s*(.*?)$', re.MULTILINE)
+    text = re.sub(markdown_header_pattern, lambda m: f'\n*{m.group(2).strip()}*\n', text)
+
+    # Convert Markdown links to AsciiDoc format
+    markdown_link_pattern = re.compile(r'\[([^\]]+)\]\(([^)]+)\)')
+    text = re.sub(markdown_link_pattern, lambda m: f'{m.group(2)}[{m.group(1)}]', text)
+
+    return text
+
+
 @dataclass
 class UpdateEntry:
     """A class schema for downloadable update entries."""