Se teleport rules #10
Conversation
panther_detections/providers/teleport/rules/create_user_accounts.py
Outdated
Show resolved
Hide resolved
* crowdstrike rule conversion * query placeholder * fix * fix * crwdstrike cleanup * cleanup gsuite detections from branch * remove file * Automatically commit format changes * lint cleanup * Automatically commit format changes * initial crowdstrike tests * initial crowdstrike tests * initial test cleanup * fix alert_context * Automatically commit format changes * add unit tests * Automatically commit format changes * remove non exportables * Automatically commit format changes * resolve exportable * Automatically commit format changes * fix shared attributes * Automatically commit format changes * linting * revert change * updated log types * updated log types schema * Automatically commit format changes * refresh * bumping panther-sdk version * updated queries to pass test * Automatically commit format changes * refresh --------- Co-authored-by: jzandona <[email protected]>
|
We recently merged in some changes that should simplify the prefilter interaction in favor of extensions .. see this PR as a reference Impact on your PR from my understanding is mostly around your pre_filters parameter being changed to extensions |
panther_detections/providers/teleport/rules/network_scanning.py
Outdated
Show resolved
Hide resolved
| from ._shared import * | ||
|
|
||
|
|
||
| def use_all_with_defaults() -> List[Union[detection.Rule]]: |
There was a problem hiding this comment.
hmm we shouldn't be returning the rules .. see here
There was a problem hiding this comment.
Made that change due to this comment here https://github.com/panther-labs/panther-detections/pull/9#discussion_r1104687951.
There was a problem hiding this comment.
interesting, yeah any change we make we should be consistent through out the project. @maxrichie5 what was your vision for this change you recommended? Is there plans to circle back and make other calls consistent?
There was a problem hiding this comment.
My vision here was that anything a user calls to create content should be returned to the user (most likely so it can be tested, but I think it is good overall)
We should do this going forward and it would awesome to clean up the stuff that hasn't been changed, but there is no planned work for that
Background
Initial teleport rules and test cases
Changes
Introduce teleport rules and test cases SDK, introduced
legacy_utilsto handle cases where deep_get is needed on non PantherEvent objects and pattern_match_filter is used.Testing
make test,panther_analysis_tool sdk test