opensearch-project / opensearch-project/security-analytics
[SRE] Implement RuleParser interface and SigmaV1 implementation
Open
Nobody has claimed this yet.
enhancement
- Dominant language
- Java
- Stars
- 111
- Forks
- 111
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 13
Description
Related #993
The RuleParser is the interface responsible for taking a the raw rule data and converting it into a the format used by the SRE for rule evaluation. As part of this task, an implementation will be created to support the Sigma V1 rule schema
Sub-tasks
- Create interface
- Create Sigma V1 implementation
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the RuleParser interface described in the issue and the Sigma V1 rule schema used by the Security Analytics rule evaluation flow. Define completion as having the interface and a Sigma V1 implementation that converts raw rule data into the format required for evaluation; no files or tests are named in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100