elastic / elastic/detection-rules

[Meta] Refactor Rule Create and Importer Logic

Open
#3,557 2 comments 0 reactions 0 assignees View on GitHub
backlog enhancement Meta python Team: TRADE
Dominant language
Python
Stars
2.7k
Forks
696
Avg merge
4d 17h
Merged PRs (30d)
87

Description

## Parent Epic (If Applicable)

https://github.com/elastic/ia-trade-team/issues/810

## Meta Summary

The create-rule and import-rule CLI commands both use the rule_prompt method. It currently interactively will prompt for any fields missing.
- The core method `rule_prompt` should be refactored to handle nested methods.
- Ideally prompt is one option or fields of the rule schema can by supplied as well by command line.
- Create and import should be able to handle all rule types and features that we support.
- Users should be able to import optional fields but also skip the prompt on fields not provided.

## Estimated Time to Complete
1 - 2 sprints

## Potential Blockers

None

## Tasklist

```[tasklist]
### Meta Tasks
- [ ] Provide Week 1 Update Comment
- [ ] Provide Week 2 Update or Closeout Comment
- [ ] Refactor `rule_prompt` to handle the requirements mentioned above.
- [ ] Provide test cases for each rule type and features.
- [ ] Test all rule types supported can be exported from Elastic Security as an ndjson and imported all at once.
```

## Resources / References

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.