Playbook YAML file deleted

[DrOnionMaster]

So I was trying to diagnose an issue where the custom filters build on playbook rules were not being followed and I ran into another issue. When I try to use so-elastalert-test on one of the noisier alerts I am trying to apply custom filters to I run into a problem where the output says the play does not exist. See below for the output of so-elastalert-test

Traceback (most recent call last):
  File "/usr/local/bin/elastalert-test-rule", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/usr/local/lib/python3.11/site-packages/elastalert/test_rule.py", line 511, in main
    test_instance.run_rule_test()
  File "/usr/local/lib/python3.11/site-packages/elastalert/test_rule.py", line 457, in run_rule_test
    rule_yaml = conf['rules_loader'].load_yaml(self.args.file)
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/elastalert/loaders.py", line 253, in load_yaml
    loaded = self.get_yaml(current_path)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/elastalert/loaders.py", line 585, in get_yaml
    return read_yaml(filename)
           ^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/elastalert/yaml.py", line 6, in read_yaml
    with open(path) as f:
         ^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '/opt/elastalert/rules/playbook/1540ec71c.yaml'

I have no idea how this got removed but I don't know how to get the YAML file back. Do I need to recreate it from scratch? I tried running so-playbook-sync but this didn't do anything to solve this issue.

[dougburks]

Please try the new Detections interface in 2.4.70:
https://docs.securityonion.net/en/2.4/detections.html