Graylog2 / Graylog2/graylog2-server
Content Packs: Make it optional to include all rules of a pipeline
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
When I create a content pack and include a pipeline, the content packs mechanism will automatically include all the rules that this pipeline references.
This is OK in many use-cases, but for our internal content production, we rely on other content packs to provide some rules. For example, a firewall content pack would reference rules for reverse DNS or threat intel lookups. However, I don't want to ship each content pack with a copy of those rules. To avoid this, we are instructing the user to install a "base" content pack first. Now, when I create a new content pack. I have to immediately create a second revision and remove all those pipeline rules that were included by default to avoid installation errors.
I'd love to have an option to select if I want to include all referenced pipeline rules or not.
(@kroepke: Please schedule this as it fits, but be advised that this *could* jump up in urgency if the content project gets it's own real feet)
## Your Environment
* Graylog Version: 3.0.0+db6cf59
Contributor guide
Assessment
This issue has not been assessed yet.