elastic / elastic/detection-rules

[FR][DAC] Consideration: Support Bulk Actions

Open
#3,962 0 comments 0 reactions 0 assignees View on GitHub
backlog detections-as-code enhancement
Dominant language
Python
Stars
2.7k
Forks
696
Avg merge
4d 17h
Merged PRs (30d)
87

Description

related to #3407

---

**This is a consideration and not a commitment to work at this point**. We should review the feasibility and supportability. If it is doable and not deemed maintainable, we can move the example code to the DAC reference for users to manually implement.

---

- The current `actions.py` schemas need to be looked at closer to confirm that they accurately match what kibana expects and known limitations. (e.g. `throttle`)
- We need to develop a decision tree to determine the precedence (should actions defined in rules or actions defined in the toml be authoritative)
- We need to bundle the actions.toml files when exporting / importing

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.