Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature] Add support for prebuilt rules #750

Open
tehbooom opened this issue Sep 3, 2024 · 0 comments
Open

[Feature] Add support for prebuilt rules #750

tehbooom opened this issue Sep 3, 2024 · 0 comments
Labels
enhancement New feature or request

Comments

@tehbooom
Copy link
Member

tehbooom commented Sep 3, 2024

Is your feature request related to a problem? Please describe.
I would like to manage all rules using terraform to include prebuilt ones from Elastic.

Describe the resource you would like to have implemented.
Add another resource like elasticstack_kibana_prebuilt_rule that installs or updates all prebuilt rules from elastic. Optionally enable or disable rules based on alert.attribute.tags using POST api/detection_engine/rules/_bulk_action

Describe the solution you'd like
Enable rules by alert.attribute.tags

resource "elasticstack_kibana_prebuilt_rule" "example" {
  tags = [
    "OS: Linux",
    "OS: Windows",
    "Data Source: GCP"
  ]
}

This would enable all rules

resource "elasticstack_kibana_prebuilt_rule" "example" {
  tags = ["all"]
}

This would install the rules but not enable them

resource "elasticstack_kibana_prebuilt_rule" "example" {
  tags = []
}

Only run if tags is updated or if GET api/detection_engine/rules/prepackaged/_status returns rules_not_installed or rules_not_updated is greater than or equal to 1.

Describe alternatives you've considered
Using ansible.builtin.uri or curl as an alternative

Additional context
Add any other context or screenshots about the feature request here.

@tehbooom tehbooom added the enhancement New feature or request label Sep 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant