@@ -231,13 +231,14 @@ true
231231
232232{ {/*
233233 This function checks if the response_actions feature is enabled for the host.
234- It first checks the additional_settings and then the features.
234+ It first checks host. additional_settings.features.respond/responding, then features.respond/responding .
235235 If neither is found, it defaults to false .
236236*/} }
237237{ {- define " host.response_actions_enabled" } }
238- { {- $feature_respond := dig " respond " (dict) .Values.features } }
238+ { {- $respondKey := include " host.respond_key " .Values.features } }
239239{ {- $additional_features := dig " features" (dict) .Values.host.additional_settings } }
240- { {- $additional_respond := dig " respond" (dict) $additional_features } }
240+ { {- $additional_respond := dig $respondKey (dict) $additional_features } }
241+ { {- $feature_respond := dig $respondKey (dict) .Values.features } }
241242{ {- if hasKey $additional_respond " response_actions" } }
242243{ {- dig " response_actions" " enabled" false $additional_respond -} }
243244{ {- else if hasKey $feature_respond " response_actions" } }
@@ -249,12 +250,14 @@ true
249250 This function checks if response actions that need higher privileges are enabled.
250251 These include : file_acquire, file_quarantine, and get_logs.
251252 Returns true if response_actions is enabled AND at least one of these actions has trigger != " none" .
253+ Checks host.additional_settings first, then features.
252254*/} }
253255{ {- define " host.response_actions_needs_higher_privileges" } }
254256{ {- if eq (include " host.response_actions_enabled" .) " true" } }
255- { {- $feature_respond := dig " respond " (dict) .Values.features } }
257+ { {- $respondKey := include " host.respond_key " .Values.features } }
256258{ {- $additional_features := dig " features" (dict) .Values.host.additional_settings } }
257- { {- $additional_respond := dig " respond" (dict) $additional_features } }
259+ { {- $additional_respond := dig $respondKey (dict) $additional_features } }
260+ { {- $feature_respond := dig $respondKey (dict) .Values.features } }
258261{ {- $response_actions := dict } }
259262{ {- if hasKey $additional_respond " response_actions" } }
260263 { {- $response_actions = get $additional_respond " response_actions" } }
0 commit comments