Skip to content

Add related_integrationsto post transform build process #2057

@Mikaayenson

Description

@Mikaayenson
  • Make _post_dict_transform a class object
  • Make sure we reference Package Version so may need to remove static method
  • Build and test to make sure fields are added on runtime.
  • Check integrations based on packages manifest
  • Get integrations from event query information
import requests
import yaml

def is_packaged_integration(integration_name: str) -> bool:
    response = requests.get(f"[https://raw.githubusercontent.com/elastic/integrations/main/packages/{integration_name}/manifest.yml](https://raw.githubusercontent.com/elastic/integrations/main/packages/%7Bintegration_name%7D/manifest.yml)")
    manifest = yaml.safe_load(response.content)

    # has multiple integrations in the package
    return len(manifest.get("policy_templates")) > 1


for index in indices:
    if not index.startswith('logs-'):
        continue
    _, full_name, _ = index.lsplit('-', 1)
    integration, _ = full_name.lsplit('.*-', 1)
    if parsed in EXCLUSIONS:
        continue
    return integration


 fields = get_unique_query_fields(rule)
  if fields:
      indices = rule.contents.data.index
      if not any("logs-" in index for index in indices):
          print(f"Skipping rule: '{rule.name}', that doesn't include integrations")
          continue

Additional Context

Metadata

Metadata

Labels

pythonInternal python for the repositoryv8.4.0

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions