Cogburn/public id on duplicate #457
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Smarter Duplicate functionality in ElastAlert. Instead of removing metadata and leaving the source unchanged, we're updating the metadata and the source so there's no half-integrity detections in ES, i.e. every detection should have ExtractDetails called on it before going into ES, no exceptions. Other engines stubbed for now to meet the interface change. WIP. Added a mock to Userstore for testing. Updated existing tests. Added new test. Also, while testing something with `Detectionstore.GetDetectionByPublicId` I noticed that our `getByPublicId` handler wasn't using this helper function. Refactored to use it for consistency. Ran `go mod tidy`
The same additions added to ElastAlert, but this time Suricata.
coreyogburn
force-pushed
the
cogburn/publicId-on-duplicate
branch
from
9d21133 to
f8dbb8d
Compare
Move common detection functions and constants to a new top-level detections package. Use UPPER_SNAKE case for constants. Test generateUnusedPublicId functions. Break up Suricata DuplicateDetection for extra logic around setting title, publicId.
jertel
approved these changes
May 1, 2024
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Smarter Duplicate functionality. Instead of removing metadata and leaving the source unchanged, we're updating the metadata and the source so there's no half-integrity detections in ES, i.e. every detection should have ExtractDetails called on it before going into ES, no more exceptions.
Added a mock to Userstore for testing. Updated existing tests. Added new test.
Also, while testing something with
Detectionstore.GetDetectionByPublicIdI noticed that ourgetByPublicIdhandler wasn't using this helper function. Refactored to use it for consistency.Ran
go mod tidy