opensearch-project / opensearch-project/security-analytics
[Meta] Streaming Rule Engine
@engechas is already working on this.
Since Apr 25, 2024.
- Dominant language
- Java
- Stars
- 111
- Forks
- 111
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 13
Description
Background
The Streaming Rule Engine (SRE) is an alternative mechanism to perform rule evaluation. The SRE decouples threat hunting from OpenSearch by providing a platform-agnostic rule evaluator. At a high level, the SRE accepts a configuration to retrieve the rules from an external storage system and then operates on a stream of incoming data to generate matches based on the provided rules.
Design
The SRE will have pluggable support for various data types and formats, such as CloudTrail or OCSF. The schema used to define rules and the mechanism to retrieve rules from an external store are also pluggable.
Tasks
- #994
- #995
- #996
- #997
- #998
- #999
- #1000
- #1001
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.