diff --git a/detection_rules/main.py b/detection_rules/main.py index 84e197ba6..c95ef2c99 100644 --- a/detection_rules/main.py +++ b/detection_rules/main.py @@ -93,7 +93,7 @@ def generate_rules_index(ctx: click.Context, query, overwrite, save_files=True): @click.argument('input-file', type=click.Path(dir_okay=False, exists=True), nargs=-1, required=False) @click.option('--directory', '-d', type=click.Path(file_okay=False, exists=True), help='Load files from a directory') def import_rules(input_file, directory): - """Import rules from json, toml, or Kibana exported rule file(s).""" + """Import rules from json, toml, yaml, or Kibana exported rule file(s).""" rule_files = glob.glob(os.path.join(directory, '**', '*.*'), recursive=True) if directory else [] rule_files = sorted(set(rule_files + list(input_file))) diff --git a/detection_rules/utils.py b/detection_rules/utils.py index b7ef0bf44..265742c52 100644 --- a/detection_rules/utils.py +++ b/detection_rules/utils.py @@ -326,8 +326,10 @@ def load_rule_contents(rule_file: Path, single_only=False) -> list: return contents or [{}] elif extension == '.toml': rule = pytoml.loads(raw_text) + elif extension.lower() in ('yaml', 'yml'): + rule = load_dump(str(rule_file)) else: - rule = load_dump(rule_file) + return [] if isinstance(rule, dict): return [rule]