diff --git a/detection_rules/packaging.py b/detection_rules/packaging.py index a62b4ffa2..57272dcc3 100644 --- a/detection_rules/packaging.py +++ b/detection_rules/packaging.py @@ -112,7 +112,12 @@ def manage_versions(rules: List[TOMLRule], deprecated_rules: list = None, curren if save_changes: if changed_rules or (new_rules and add_new): - current_versions.update(new_rules if add_new else {}) + if add_new: + for rule in new_rules: + current_versions[rule.id] = rule.contents.lock_info() + for rule in changed_rules: + current_versions[rule.id] = rule.contents.lock_info() + current_versions = OrderedDict(sorted(current_versions.items(), key=lambda x: x[1]['rule_name'])) save_etc_dump(current_versions, 'version.lock.json') diff --git a/detection_rules/rule.py b/detection_rules/rule.py index 5d14e6f1c..740e4e1e8 100644 --- a/detection_rules/rule.py +++ b/detection_rules/rule.py @@ -324,6 +324,9 @@ class TOMLRuleContents(MarshmallowDataclassMixin): def name(self) -> str: return self.data.name + def lock_info(self) -> dict: + return {"rule_name": self.name, "sha256": self.sha256(), "version": self.autobumped_version} + @property def is_dirty(self) -> Optional[bool]: """Determine if the rule has changed since its version was locked."""