From a8dbf2cf1642c732317269a7584168d696c1fb7b Mon Sep 17 00:00:00 2001
From: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com>
Date: Wed, 3 Dec 2025 12:19:29 -0500
Subject: [PATCH] [FR] Expand CUSTOM_RULES_DIR to support user relative paths
 (#5390)

* Add user relative path support
---
 detection_rules/config.py | 2 +-
 pyproject.toml            | 2 +-
 tests/base.py             | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/detection_rules/config.py b/detection_rules/config.py
index 132ba0cc2..33be0050b 100644
--- a/detection_rules/config.py
+++ b/detection_rules/config.py
@@ -227,7 +227,7 @@ def parse_rules_config(path: Path | None = None) -> RulesConfig:  # noqa: PLR091
             raise ValueError(f"rules config file does not exist: {path}")
         loaded = yaml.safe_load(path.read_text())
     elif CUSTOM_RULES_DIR:
-        path = Path(CUSTOM_RULES_DIR) / "_config.yaml"
+        path = Path(CUSTOM_RULES_DIR).expanduser() / "_config.yaml"
         if not path.exists():
             raise FileNotFoundError(
                 """
diff --git a/pyproject.toml b/pyproject.toml
index 34a5e74d3..696d25b17 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "detection_rules"
-version = "1.5.18"
+version = "1.5.19"
 description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
 readme = "README.md"
 requires-python = ">=3.12"
diff --git a/tests/base.py b/tests/base.py
index cbd3d5259..52280d35b 100644
--- a/tests/base.py
+++ b/tests/base.py
@@ -26,7 +26,7 @@ RULES_CONFIG = parse_rules_config()
 def load_rules() -> RuleCollection:
     if CUSTOM_RULES_DIR:
         rc = RuleCollection()
-        path = Path(CUSTOM_RULES_DIR)
+        path = Path(CUSTOM_RULES_DIR).expanduser()
         assert path.exists(), f"Custom rules directory {path} does not exist"
         rc.load_directories(directories=RULES_CONFIG.rule_dirs)
         rc.freeze()
@@ -62,7 +62,7 @@ class BaseRuleTest(unittest.TestCase):
                 RULE_LOADER_FAIL = True
                 RULE_LOADER_FAIL_MSG = str(e)
 
-        cls.custom_dir = Path(CUSTOM_RULES_DIR).resolve() if CUSTOM_RULES_DIR else None
+        cls.custom_dir = Path(CUSTOM_RULES_DIR).expanduser().resolve() if CUSTOM_RULES_DIR else None
         cls.rules_config = RULES_CONFIG
 
     @staticmethod