Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

santactl rule should allow clearing ruleset #1293

Closed
russellhancox opened this issue Feb 14, 2024 Discussed in #1292 · 1 comment · Fixed by #1300
Closed

santactl rule should allow clearing ruleset #1293

russellhancox opened this issue Feb 14, 2024 Discussed in #1292 · 1 comment · Fixed by #1300

Comments

@russellhancox
Copy link
Contributor

Discussed in #1292

Originally posted by jumpsdefcon February 14, 2024
So, was doing some testing with an agent that is not using a sync server, and was looking to manual import the json rule list. I got the list to import fine, but when I try to import a different rule list I still see the full list of rules in the database. Do I need to script out a removal line by line and then re-import the new list or perhaps script removal and reinstall of the agent?

I would have expected the import to purge the current list and then import the rules in the new config file.

We should add a --clean flag that can both delete all rules on its own or clean before importing new when combined with the --import flag.

@pmarkowsky
Copy link
Contributor

In order to match the sync behavior we'll need a --clean and a --clean-all flag.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants