Dynamically add Data Needed to Customer by DR #212
Conversation
I like the dynamic way how a detection rule is able to declare the data needed part. This change will extend the list of DN for a customer depending on the detection rules which are applied to the customer.
|
Hello @andurin! This functionality looks pretty good, at the same time it interferes with the idea behind the Customer entity. The idea behind the Customer entityThe Customer entity originally was created to track the deployment/implementation of Detection Rules. Then you can put there Data Needed, and rebuild the es index, then highlight what Detection Rules you can deploy with this data. Then track implementation — what detection rules have been implemented, what detection rules could be implemented but haven't implemented yet. So if we will automatically calculate Data Needed, that will break this idea. The win-win solutionI think that many of our users could benefit from your idea. This way people that would need this, would be able to enable it in the config and it will not interfere with the original idea (: |
I like the dynamic way how a detection rule is able to declare the data
needed part.
This change will extend the list of DN for a customer depending on the
detection rules which are applied to the customer.