diff --git a/detection_rules/packaging.py b/detection_rules/packaging.py index 57272dcc3..fc152ddfa 100644 --- a/detection_rules/packaging.py +++ b/detection_rules/packaging.py @@ -21,7 +21,7 @@ from . import rule_loader from .misc import JS_LICENSE, cached from .rule import TOMLRule, BaseQueryRuleData, RULES_DIR, ThreatMapping from .rule import downgrade_contents_from_rule -from .schemas import CurrentSchema +from .schemas import CurrentSchema, definitions from .utils import Ndjson, get_path, get_etc_path, load_etc_dump, save_etc_dump RELEASE_DIR = get_path("releases") @@ -485,7 +485,7 @@ class Package(object): package_dir = Path(save_dir).joinpath(manifest.version) docs_dir = package_dir / 'docs' - rules_dir = package_dir / 'kibana' / 'security_rule' + rules_dir = package_dir / 'kibana' / definitions.ASSET_TYPE docs_dir.mkdir(parents=True) rules_dir.mkdir(parents=True) @@ -498,7 +498,8 @@ class Package(object): # shutil.copyfile(CHANGELOG_FILE, str(rules_dir.joinpath('CHANGELOG.json'))) for rule in self.rules: - rule.save_json(Path(rules_dir.joinpath(f'rule-{rule.id}.json'))) + with Path(rules_dir.joinpath(f'rule-{rule.id}.json')).open("w", encoding="utf-8") as f: + json.dump(rule.get_asset(), f, indent=2, sort_keys=True) readme_text = ('# Detection rules\n\n' 'The detection rules package stores all the security rules ' diff --git a/detection_rules/rule.py b/detection_rules/rule.py index 740e4e1e8..d2f4704c8 100644 --- a/detection_rules/rule.py +++ b/detection_rules/rule.py @@ -432,6 +432,10 @@ class TOMLRule: def name(self): return self.contents.data.name + def get_asset(self) -> dict: + """Generate the relevant fleet compatible asset.""" + return {"id": self.id, "attributes": self.contents.to_api_format(), "type": definitions.ASSET_TYPE} + def save_toml(self): converted = self.contents.to_dict() toml_write(converted, str(self.path.absolute())) diff --git a/detection_rules/schemas/definitions.py b/detection_rules/schemas/definitions.py index 9b2698229..96204cb3f 100644 --- a/detection_rules/schemas/definitions.py +++ b/detection_rules/schemas/definitions.py @@ -10,6 +10,8 @@ from typing import Literal from marshmallow import validate from marshmallow_dataclass import NewType +ASSET_TYPE = "security_rule" + DATE_PATTERN = r'\d{4}/\d{2}/\d{2}' MATURITY_LEVELS = ['development', 'experimental', 'beta', 'production', 'deprecated'] OS_OPTIONS = ['windows', 'linux', 'macos']