[FR] Add support to decouple actions and exceptions

[brokensound77]

Issues

part of elastic/ia-trade-team/issues/258

Summary

Details forthcoming

TODO

• helper methods from within TomlRuleContents to help associate rule <=> exceptions
  • this includes the "build time" functionality from # 2 above

[brokensound77]

TODo: update with https://www.elastic.co/guide/en/security/current/bulk-actions-rules-api.html#actions-object-schema-bulk

[Mikaayenson]

Should action list be associated to only one rule or multiple rules?

[Mikaayenson]

@brokensound77 here is an example toml file based on the actions:

[metadata]
creation_date = "2024-02-21"
rule_id = "5d1e96c6-1ee8-4f19-9416-1d8d81428f59"
rule_name = "Example Rule Name"
updated_date = "2024-02-22"
deprecation_date = "2025-01-01"      # optional
comments = "This is an example action list" # optional
maturity = "beta"                    # optional

[[actions]]
action_type_id = ".email"
group = "default"
params.message = "Action triggered: Example Rule Name"
id = "action_001"                    # optional
frequency = { "throttle": "5m" }     # optional  

[[actions]]
action_type_id = ".slack"
group = "default"
params.message = "Some other notification"

I noticed that ActionParams may need to be updated and alerts_filter added.

[Mikaayenson]

Sample exception list file:

[metadata]
creation_date = "2024-02-21"
rule_id = "5d1e96c6-1ee8-4f19-9416-1d8d81428f59"
rule_name = "Example Rule Name"
updated_date = "2024-02-22"
comments = "This is an example exception list."
maturity = "development"

[[exceptions]]
description = "Example exception container"
list_id = "exception_list_01"
name = "Sample Exception List"
namespace_type = "single"
tags = ["tag1", "tag2"]
type = "detection"

  [[exceptions.items]]
  description = "Exception item description"
  list_id = "item_list_01"
  name = "Exception Item Name"
  namespace_type = "single"
  tags = ["exception_item_tag1"]
  type = "simple"
  expire_time = "2024-12-31T23:59:59Z"

    [[exceptions.items.entries]]
    field = "process.name"
    type = "match_any"
    operator = "included"
    value = ["malicious_process", "another_process"]

    [[exceptions.items.entries]]
    field = "nested.field.example"
    type = "nested"
    operator = "included"

      [[exceptions.items.entries.entries]]
      field = "nested.inside"
      type = "match"
      operator = "included"
      value = "specific_value"

[Mikaayenson]

Will there be unit tests that load this Generic Collection? Just thinking about how a user will test this prior to trying to push to kibana and loading everything.

[brokensound77]

Not built in - but if they wanted to unit test similar to how we do rules, they would just need to load and test

[Mikaayenson]

you mean use the loader to "test" in terms of schema validation, but no unit testing explicitly for field validation?

[Mikaayenson]

Do we need all the same metadata like rule information if a user wants to directly add schemas to the toml file?