security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FR] [DaC] Add fine-grained bypass env var for ES|QL keep and metadata validation (#5869)

Browse Source 
* Add fine grain 'keep' req bypass

* Add metadata bypass
This commit is contained in:
Eric Forte
2026-03-24 14:36:45 -04:00
committed by GitHub
parent b14dec9efa
commit 75ffa5ec4e
9 changed files with 196 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detection_rules/utils.py
+13 -4
View File
@@ -136,12 +136,21 @@ def save_etc_dump(contents: dict[str, Any], path: list[str], sort_keys: bool = T
eql.utils.save_dump(contents, path) # type: ignore[reportUnknownVariableType]
# Top-level _config.yaml key -> DR_BYPASS_* env var set when true at load time
OPTIONAL_ELASTIC_VALIDATION_BYPASS_ENV: dict[str, str] = {
"bypass_note_validation_and_parse": "DR_BYPASS_NOTE_VALIDATION_AND_PARSE",
"bypass_bbr_lookback_validation": "DR_BYPASS_BBR_LOOKBACK_VALIDATION",
"bypass_tags_validation": "DR_BYPASS_TAGS_VALIDATION",
"bypass_timeline_template_validation": "DR_BYPASS_TIMELINE_TEMPLATE_VALIDATION",
"bypass_esql_keep_validation": "DR_BYPASS_ESQL_KEEP_VALIDATION",
"bypass_esql_metadata_validation": "DR_BYPASS_ESQL_METADATA_VALIDATION",
}
def set_all_validation_bypass(env_value: bool = False) -> None:
"""Set all validation bypass environment variables."""
os.environ["DR_BYPASS_NOTE_VALIDATION_AND_PARSE"] = str(env_value)
os.environ["DR_BYPASS_BBR_LOOKBACK_VALIDATION"] = str(env_value)
os.environ["DR_BYPASS_TAGS_VALIDATION"] = str(env_value)
os.environ["DR_BYPASS_TIMELINE_TEMPLATE_VALIDATION"] = str(env_value)
for env_var in OPTIONAL_ELASTIC_VALIDATION_BYPASS_ENV.values():
os.environ[env_var] = str(env_value)
def set_nested_value(obj: dict[str, Any], compound_key: str, value: Any) -> None: