[BUG] Changes doc level query name field from id to rule name and adds validation

[jowg-amazon]

Description

Changes doc level query name field from id to rule name.

Adds validation check for Sigma rule title during rule creation/updation. Sigma rule title is restricted so that it must be 1 - 256 chars as per Sigma rule specifications.

https://github.com/SigmaHQ/sigma/wiki/Specification/10f4159a3ee87c2f322a137bad6cdad313a169ab#title

Issues Resolved

PR related to:

• Change doc level query name validation common-utils#630
• Add validation check for doc level query name during monitor creation alerting#1506

Check List

• New functionality includes testing.
  • All tests pass
• New functionality has been documented.
  • New functionality has javadoc added
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[engechas]

Minor: since we use this pattern in both SA and alerting, we should move it to common utils so that it can be defined in one place. It would be easy to miss updating this pattern in either alerting or SA if it changes in the future

[jowg-amazon]

Moved the validation to common utils inside ValidationHelpers.kt

[riysaxen-amzn]

i see many tests are failing.. can we check that

[jowg-amazon]

i see many tests are failing.. can we check that

They're failing because of common util changes, will rerun the CIs

[riysaxen-amzn]

better way to write

String title = rule.containsKey("title") ? rule.get("title").toString() : "";
validateTitle(title);

// Validation method
private void validateTitle(String title) {
    if (!title.matches("^.{1,256}$")) {
        errors.add(new SigmaTitleError("Sigma rule title can be max 256 characters"));
    }
}

[jowg-amazon]

Can do this in a follow up PR, I did it this way to remain consistent with how we do the other validation checks right now.

[riysaxen-amzn]

Approved with a minor comment. Also, let's make sure CI passes atleast once even if the tests are flaky

[opensearch-trigger-bot]

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.x 2.x
# Navigate to the new working tree
cd .worktrees/backport-2.x
# Create a new branch
git switch --create backport/backport-972-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 b86ee635b0d1c1039af69e2b0de6add1b3f63bc3
# Push it to GitHub
git push --set-upstream origin backport/backport-972-to-2.x
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-972-to-2.x.

[opensearch-trigger-bot]

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.x 2.x
# Navigate to the new working tree
cd .worktrees/backport-2.x
# Create a new branch
git switch --create backport/backport-972-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 b86ee635b0d1c1039af69e2b0de6add1b3f63bc3
# Push it to GitHub
git push --set-upstream origin backport/backport-972-to-2.x
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-972-to-2.x.

[opensearch-trigger-bot]

The backport to 2.11 failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/security-analytics/backport-2.11 2.11
# Navigate to the new working tree
pushd ../.worktrees/security-analytics/backport-2.11
# Create a new branch
git switch --create backport-972-to-2.11
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 b86ee635b0d1c1039af69e2b0de6add1b3f63bc3
# Push it to GitHub
git push --set-upstream origin backport-972-to-2.11
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/security-analytics/backport-2.11

Then, create a pull request where the base branch is 2.11 and the compare/head branch is backport-972-to-2.11.