in detection_rules/rule.py [0:0]
def validate_note(self):
if self.skip_validate_note or not self.note:
return
try:
for child in self.parsed_note.children:
if child.get_type() == "Heading":
header = gfm.renderer.render_children(child)
if header.lower() == "setup":
# check that the Setup header is correctly formatted at level 2
if child.level != 2:
raise ValidationError(f"Setup section with wrong header level: {child.level}")
# check that the Setup header is capitalized
if child.level == 2 and header != "Setup":
raise ValidationError(f"Setup header has improper casing: {header}")
self.setup_in_note = True
else:
# check that the header Config does not exist in the Setup section
if child.level == 2 and "config" in header.lower():
raise ValidationError(f"Setup header contains Config: {header}")
except Exception as e:
raise ValidationError(f"Invalid markdown in rule `{self.name}`: {e}. To bypass validation on the `note`"
f"field, use the environment variable `DR_BYPASS_NOTE_VALIDATION_AND_PARSE`")
# raise if setup header is in note and in setup
if self.setup_in_note and (self.setup and self.setup != "None"):
raise ValidationError("Setup header found in both note and setup fields.")