-
- {reference.value}
-
-
+
+
+
+
+ Source
+ {prePackaged ? 'Sigma' : 'Custom'}
+
+ {prePackaged ? (
+
+ License
+
+ Detection Rule License (DLR)
+
+
+ ) : null}
+
+
+
+
+
+
+ Rule level
+ {ruleData.level}
+
+
+
+
+
+
Tags
+ {ruleData.tags.length > 0 ? (
+
+ {ruleData.tags.map((tag: any, i: number) => (
+
+ {tag.value}
+
+ ))}
+
+ ) : (
+
{DEFAULT_EMPTY_DATA}
+ )}
+
+
+
+
+
References
+ {ruleData.references.length > 0 ? (
+ ruleData.references.map((reference: any, i: number) => (
+
+
+ {reference.value}
+
+
+
+ ))
+ ) : (
+
{DEFAULT_EMPTY_DATA}
+ )}
+
+
+
+
False positive cases
+
+ {ruleData.false_positives.length > 0 ? (
+ ruleData.false_positives.map((falsepositive: any, i: number) => (
+
+ {falsepositive.value}
+
+
+ ))
+ ) : (
+
{DEFAULT_EMPTY_DATA}
+ )}
- ))
- ) : (
-
{DEFAULT_EMPTY_DATA}
- )}
-
-
-
False positive cases
-
- {ruleData.false_positives.length > 0 ? (
- ruleData.false_positives.map((falsepositive: any, i: number) => (
-
- {falsepositive.value}
-
-
- ))
- ) : (
-
{DEFAULT_EMPTY_DATA}
- )}
-
-
-
-
-
Rule Status
-
{ruleData.status}
-
-
-
-
-
- {ruleData.detection}
-
-
+
+
+
Rule Status
+
{ruleData.status}
+
+
+
+
+
+ {ruleData.detection}
+
+
+
+ )}
+ {selectedEditorType === 'yaml' && (
+
+
+
+ )}
);
};
diff --git a/public/pages/Rules/components/RuleContentViewer/RuleContentYamlViewer.test.tsx b/public/pages/Rules/components/RuleContentViewer/RuleContentYamlViewer.test.tsx
new file mode 100644
index 000000000..8c1571c8d
--- /dev/null
+++ b/public/pages/Rules/components/RuleContentViewer/RuleContentYamlViewer.test.tsx
@@ -0,0 +1,51 @@
+/*
+ * Copyright OpenSearch Contributors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import React from 'react';
+import { render } from '@testing-library/react';
+import { RuleContentYamlViewer } from './RuleContentYamlViewer';
+
+describe('
spec', () => {
+ it('renders the component', () => {
+ const { container } = render(
+
+ );
+ expect(container.firstChild).toMatchSnapshot();
+ });
+});
diff --git a/public/pages/Rules/components/RuleContentViewer/RuleContentYamlViewer.tsx b/public/pages/Rules/components/RuleContentViewer/RuleContentYamlViewer.tsx
new file mode 100644
index 000000000..2ef66cc0c
--- /dev/null
+++ b/public/pages/Rules/components/RuleContentViewer/RuleContentYamlViewer.tsx
@@ -0,0 +1,24 @@
+/*
+ * Copyright OpenSearch Contributors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { EuiCodeBlock } from '@elastic/eui';
+import React from 'react';
+import { mapRuleToYamlObject, mapYamlObjectToYamlString } from '../../utils/mappers';
+import { Rule } from '../../../../../models/interfaces';
+
+export interface RuleContentYamlViewerProps {
+ rule: Rule;
+}
+
+export const RuleContentYamlViewer: React.FC
= ({ rule }) => {
+ const yamlObject = mapRuleToYamlObject(rule);
+ const ruleYaml = mapYamlObjectToYamlString(yamlObject);
+
+ return (
+
+ {ruleYaml}
+
+ );
+};
diff --git a/public/pages/Rules/components/RuleContentViewer/__snapshots__/RuleContentViewer.test.tsx.snap b/public/pages/Rules/components/RuleContentViewer/__snapshots__/RuleContentViewer.test.tsx.snap
new file mode 100644
index 000000000..891a04d01
--- /dev/null
+++ b/public/pages/Rules/components/RuleContentViewer/__snapshots__/RuleContentViewer.test.tsx.snap
@@ -0,0 +1,341 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[` spec renders the component 1`] = `
+
+
+
+
+
+
+
+
+ My Rule
+
+
+
+
+
+ dns
+
+
+
+
+
+
+ My Rule
+
+
+
+
+
+ 2022-11-22T23:00:00.000Z
+
+
+
+ aleksandar
+
+
+
+
+
+
+ Custom
+
+
+
+
+
+
+ high
+
+
+
+
+
+ -
+
+
+
+
+
+ -
+
+
+
+
+
+
+
+ stable
+
+
+
+
+
+
+
+
+
+ id
+
+
+ :
+
+ 25b9c01c
+
+ -
+
+ 350d
+
+ -
+
+ 4b95
+
+ -
+
+ bed1
+
+ -
+
+ 836d04a4f324
+
+
+
+
+
+ logsource
+
+
+ :
+
+
+
+
+
+
+
+ product
+
+
+ :
+
+ windows
+
+
+
+
+
+ title
+
+
+ :
+
+ Testing rule
+
+
+
+
+
+ description
+
+
+ :
+
+ Testing Description
+
+
+
+
+
+ tags
+
+
+ :
+
+
+
+
+
+
+
+ -
+
+ attack.persistence
+
+
+
+
+
+ -
+
+ attack.privilege_escalation
+
+
+
+
+
+ -
+
+ attack.t1543.003
+
+
+
+
+
+ falsepositives
+
+
+ :
+
+
+
+
+
+
+
+ -
+
+ Unknown
+
+
+
+
+
+ level
+
+
+ :
+
+ high
+
+
+
+
+
+ status
+
+
+ :
+
+ experimental
+
+
+
+
+
+ references
+
+
+ :
+
+
+
+
+
+
+
+ -
+
+
+
+ 'https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831'
+
+
+
+
+
+
+
+ author
+
+
+ :
+
+ Bhabesh Raj
+
+
+
+
+
+ detection
+
+
+ :
+
+
+
+
+
+
+
+ selection
+
+
+ :
+
+
+
+
+
+
+
+ Provider_Name
+
+
+ :
+
+ Service Control Manager
+
+
+
+
+
+ EventID
+
+
+ :
+
+
+
+ 7045
+
+
+
+
+
+
+
+ ServiceName
+
+
+ :
+
+ ZzNetSvc
+
+
+
+
+
+ condition
+
+
+ :
+
+ selection
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Testing YamlRuleEditor
+
+ );
+ expect(container.firstChild).toMatchSnapshot();
+ });
+
+ it('renders the component - invalid state', () => {
+ const { container } = render(
+ {}}
+ rule={{
+ id: '25b9c01c-350d-4b95-bed1-836d04a4f324',
+ category: 'windows',
+ title: 'Testing rule',
+ description: 'Testing Description',
+ status: 'experimental',
+ author: 'Bhabesh Raj',
+ references: [
+ {
+ value: 'https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831',
+ },
+ ],
+ tags: [
+ {
+ value: 'attack.persistence',
+ },
+ {
+ value: 'attack.privilege_escalation',
+ },
+ {
+ value: 'attack.t1543.003',
+ },
+ ],
+ log_source: '',
+ detection:
+ 'selection:\n Provider_Name: Service Control Manager\n EventID: 7045\n ServiceName: ZzNetSvc\ncondition: selection\n',
+ level: 'high',
+ false_positives: [
+ {
+ value: 'Unknown',
+ },
+ ],
+ }}
+ isInvalid={true}
+ errors={['Validation error message']}
+ >
+ Testing YamlRuleEditor
+
+ );
+ expect(container.firstChild).toMatchSnapshot();
+ });
+});
diff --git a/public/pages/Rules/components/RuleEditor/components/YamlRuleEditorComponent/YamlRuleEditorComponent.tsx b/public/pages/Rules/components/RuleEditor/components/YamlRuleEditorComponent/YamlRuleEditorComponent.tsx
new file mode 100644
index 000000000..e8917122f
--- /dev/null
+++ b/public/pages/Rules/components/RuleEditor/components/YamlRuleEditorComponent/YamlRuleEditorComponent.tsx
@@ -0,0 +1,119 @@
+/*
+ * Copyright OpenSearch Contributors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import React, { useState } from 'react';
+import { load } from 'js-yaml';
+import { EuiFormRow, EuiCodeEditor, EuiLink, EuiSpacer, EuiText, EuiCallOut } from '@elastic/eui';
+import FormFieldHeader from '../../../../../../components/FormFieldHeader';
+import { Rule } from '../../../../../../../models/interfaces';
+import {
+ mapRuleToYamlObject,
+ mapYamlObjectToYamlString,
+ mapYamlObjectToRule,
+} from '../../../../utils/mappers';
+
+export interface YamlRuleEditorComponentProps {
+ rule: Rule;
+ change: React.Dispatch;
+ isInvalid: boolean;
+ errors?: string[];
+}
+
+export interface YamlEditorState {
+ errors: string[] | null;
+ value?: string;
+}
+
+export const YamlRuleEditorComponent: React.FC = ({
+ rule,
+ change,
+ isInvalid,
+ errors,
+}) => {
+ const yamlObject = mapRuleToYamlObject(rule);
+
+ const [state, setState] = useState({
+ errors: null,
+ value: mapYamlObjectToYamlString(yamlObject),
+ });
+
+ const onChange = (value: string) => {
+ setState((prevState) => ({ ...prevState, value }));
+ };
+
+ const onBlur = () => {
+ if (!state.value) {
+ setState((prevState) => ({ ...prevState, errors: ['Rule cannot be empty'] }));
+ return;
+ }
+ try {
+ const yamlObject = load(state.value);
+
+ const rule = mapYamlObjectToRule(yamlObject);
+
+ change(rule);
+
+ setState((prevState) => ({ ...prevState, errors: null }));
+ } catch (error) {
+ setState((prevState) => ({ ...prevState, errors: ['Invalid YAML'] }));
+
+ console.warn('Security Analytics - Rule Eritor - Yaml load', error);
+ }
+ };
+
+ const renderErrors = () => {
+ if (state.errors && state.errors.length > 0) {
+ return (
+
+
+ {state.errors.map((error, i) => (
+ - {error}
+ ))}
+
+
+ );
+ } else if (isInvalid && errors && errors.length > 0) {
+ return (
+
+
+ {errors.map((error, i) => (
+ - {error}
+ ))}
+
+
+ );
+ } else {
+ return null;
+ }
+ };
+
+ return (
+ <>
+ {renderErrors()}
+
+ } fullWidth={true}>
+ <>
+
+
+ Use the YAML editor to define a sigma rule. See{' '}
+
+ Sigma specification
+ {' '}
+ for rule structure and schema.
+
+
+
+
+
+
+ );
+};
diff --git a/public/pages/Rules/components/RuleEditor/components/YamlRuleEditorComponent/__snapshots__/YamlRuleEditorComponent.test.tsx.snap b/public/pages/Rules/components/RuleEditor/components/YamlRuleEditorComponent/__snapshots__/YamlRuleEditorComponent.test.tsx.snap
new file mode 100644
index 000000000..9f9c27b6e
--- /dev/null
+++ b/public/pages/Rules/components/RuleEditor/components/YamlRuleEditorComponent/__snapshots__/YamlRuleEditorComponent.test.tsx.snap
@@ -0,0 +1,36 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[` spec renders the component - invalid state 1`] = `
+
+
+
+
+
+ -
+ Validation error message
+
+
+
+
+