Graylog2 / Graylog2/graylog2-server

Content Packs: Make it optional to include all rules of a pipeline

Open
#5,799 1 comment 0 reactions 1 assignee Claimed by @kroepke View on GitHub
content-packs feature needs-discussion
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

When I create a content pack and include a pipeline, the content packs mechanism will automatically include all the rules that this pipeline references.

This is OK in many use-cases, but for our internal content production, we rely on other content packs to provide some rules. For example, a firewall content pack would reference rules for reverse DNS or threat intel lookups. However, I don't want to ship each content pack with a copy of those rules. To avoid this, we are instructing the user to install a "base" content pack first. Now, when I create a new content pack. I have to immediately create a second revision and remove all those pipeline rules that were included by default to avoid installation errors.

I'd love to have an option to select if I want to include all referenced pipeline rules or not.

(@kroepke: Please schedule this as it fits, but be advised that this *could* jump up in urgency if the content project gets it's own real feet)

## Your Environment

* Graylog Version: 3.0.0+db6cf59

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.