opensearch-project / opensearch-project/security-analytics

[Bug] A way to update sigma rules from the sigmahq repository from the dashboard gui

Open
#659 3 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Java
Stars
111
Forks
111
Avg merge
1d 17h
Merged PRs (30d)
13

Description

Is your feature request related to a problem?
I have not checked all, but many of the sigma rules in opensearch 2.10 are quite old. The screenshot below is dated 2019 - but that rule in sigmahq repo was updated last month.

What solution would you like?
It would be nice to have a mechanism to update the rules periodically pulling from the repo. Alternatively, it would be good to re-baseline the rules for future releases to use a more recent pull from sigmahq. Not sure if pulling for each release is practical - but atleast 4x a year would keep them more current/relevant.

It would also be nice in the rule listing page in the GUI to have a column that show the date the the rule was last updated. Right now you would have to click on each rule individually to see the meta info (reference the screenshot below)

What alternatives have you considered?
The alternative would be to pull the repo and use API calls to put fresh rules into our index periodically. We would need to try to match and overwrite rules with newer versions, and import newer rules.

Do you have any additional context?
image

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No files, tests, or entry points are identified in the issue. Research how Sigma rules are stored and imported, then define a design for periodic repository updates, matching and importing newer rules, and displaying each rule's last-updated date in the dashboard listing.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, frontend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.