in parseRuleData.ts [232:288]
async function getPackageRules(
name: string,
displayName: string,
ruleSummaries: RuleSummary[],
tagSummaries: Map<string, TagSummary>
) {
const githubRulesListUrl = `https://api.github.com/repos/elastic/integrations/contents/packages/${name}/kibana/security_rule`;
const githubRulesCommitsUrl = `https://api.github.com/repos/elastic/integrations/commits?path=packages%2F${name}%2Fkibana%2Fsecurity_rule&page=1&per_page=1`;
const rulesCommitsResponse = await axios.get(githubRulesCommitsUrl);
const updatedDate = new Date(
rulesCommitsResponse.data[0].commit.committer.date
);
const ruleListResponse = await axios.get(githubRulesListUrl);
for (const r of ruleListResponse.data) {
const ruleContent = await axios.get(r.download_url);
const tags = ruleContent.data.attributes.tags
.filter(x => x != 'Elastic')
.map(x => {
if (integrationsTagMap.has(x)) {
return integrationsTagMap.get(x);
} else {
return x;
}
});
tags.push('Use Case: Threat Detection');
// for now, map the tags to look more like the prebuild rules package
ruleSummaries.push({
id: ruleContent.data.id,
name: ruleContent.data.attributes.name,
tags: tags,
updated_date: updatedDate,
});
for (const t of tags) {
addTagSummary(t, tagSummaries);
}
const mappedRuleContent = {
metadata: {
updated_date: updatedDate,
source_integration: name,
source_integration_name: displayName,
},
rule: ruleContent.data.attributes,
};
mappedRuleContent.rule.tags = tags;
fs.writeFileSync(
`${RULES_OUTPUT_PATH}${ruleContent.data.id}.json`,
JSON.stringify(mappedRuleContent)
);
}
console.log(
`loaded ${ruleListResponse.data.length} rules from integration package '${name}'`
);
}