Skip to content

Add related_integrationsto post transform build process #2057

@Mikaayenson

Description

@Mikaayenson
  • Make _post_dict_transform a class object
  • Make sure we reference Package Version so may need to remove static method
  • Build and test to make sure fields are added on runtime.
  • Check integrations based on packages manifest
  • Get integrations from event query information
import requests
import yaml

def is_packaged_integration(integration_name: str) -> bool:
    response = requests.get(f"[https://raw.githubusercontent.com/elastic/integrations/main/packages/{integration_name}/manifest.yml](https://raw.githubusercontent.com/elastic/integrations/main/packages/%7Bintegration_name%7D/manifest.yml)")
    manifest = yaml.safe_load(response.content)

    # has multiple integrations in the package
    return len(manifest.get("policy_templates")) > 1


for index in indices:
    if not index.startswith('logs-'):
        continue
    _, full_name, _ = index.lsplit('-', 1)
    integration, _ = full_name.lsplit('.*-', 1)
    if parsed in EXCLUSIONS:
        continue
    return integration


 fields = get_unique_query_fields(rule)
  if fields:
      indices = rule.contents.data.index
      if not any("logs-" in index for index in indices):
          print(f"Skipping rule: '{rule.name}', that doesn't include integrations")
          continue

Additional Context

Metadata

Metadata

Labels

pythonInternal python for the repositoryv8.4.0

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions