elastic / elastic/detection-rules

[FR][DAC] Consideration: expose a callback function within `kibana export-rules` to organize the output

Open
#3,625 2 comments 0 reactions 0 assignees View on GitHub
backlog detections-as-code enhancement
Dominant language
Python
Stars
2.7k
Forks
696
Avg merge
4d 17h
Merged PRs (30d)
87

Description

**Note**: this work will target the [DAC-feature](https://github.com/elastic/detection-rules/tree/DAC-feature) branch

related to #3407

---

**This is a consideration and not a commitment to work at this point**. We should review the feasibility and supportability. If it is doable and not deemed maintainable, we can move the example code to the DAC reference for users to manually implement.

---

Many users organize the rules in a specific manner, but the `kibana export-rules` command downloads them flat. There have been requests to add a callback function to pass in code specifically to organize the save.

IMO, I don't know if this is worth the work. While it would be easy to implement, the onus should be on the implementer. An easy resolution to this problem would be to:
* store it to a temp directory as flat
* call your own function on the flat output to organize accordingly

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.