Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dynamically add Data Needed to Customer by DR #212

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from

Conversation

andurin
Copy link
Contributor

@andurin andurin commented Nov 5, 2020

I like the dynamic way how a detection rule is able to declare the data
needed part.
This change will extend the list of DN for a customer depending on the
detection rules which are applied to the customer.

I like the dynamic way how a detection rule is able to declare the data
needed part.
This change will extend the list of DN for a customer depending on the
detection rules which are applied to the customer.
@yugoslavskiy
Copy link
Member

yugoslavskiy commented Nov 11, 2020

Hello @andurin!

This functionality looks pretty good, at the same time it interferes with the idea behind the Customer entity.
Let me explain in detail and provide you with a solution.

The idea behind the Customer entity

The Customer entity originally was created to track the deployment/implementation of Detection Rules.
For example, you have configured specific Logging Policies in one Customer's environment.
You can export the current state into elasticsearch index, and highlight what Data Needed you will get now (in Kibana).

Then you can put there Data Needed, and rebuild the es index, then highlight what Detection Rules you can deploy with this data. Then track implementation — what detection rules have been implemented, what detection rules could be implemented but haven't implemented yet.

So if we will automatically calculate Data Needed, that will break this idea.

The win-win solution

I think that many of our users could benefit from your idea.
What do you think about creating an extra option in the configuration file, that will enable the function you've developed?
Something like:

automatically_map_data_needed_to_detection_rules_in_customer_entity: True

This way people that would need this, would be able to enable it in the config and it will not interfere with the original idea (:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants