Skip to content

Commit 9310395

Browse files
committed
Add --dates-import option to rule import command
Introduce a new option `--dates-import` to parse `created_at` and `updated_at` fields from rule content. This allows users to import date metadata while preventing conflicts with existing date options.
1 parent 0276aa9 commit 9310395

File tree

1 file changed

+14
-7
lines changed

1 file changed

+14
-7
lines changed

detection_rules/main.py

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,7 @@ def generate_rules_index(
164164
@click.option("--strip-none-values", "-snv", is_flag=True, help="Strip None values from the rule")
165165
@click.option("--local-creation-date", "-lc", is_flag=True, help="Preserve the local creation date of the rule")
166166
@click.option("--local-updated-date", "-lu", is_flag=True, help="Preserve the local updated date of the rule")
167+
@click.option("--dates-import", "-di", is_flag=True, help="Parse created_at and updated_at from the rule content")
167168
@click.option(
168169
"--load-rule-loading",
169170
"-lr",
@@ -184,11 +185,16 @@ def import_rules_into_repo( # noqa: PLR0912, PLR0913, PLR0915
184185
strip_none_values: bool,
185186
local_creation_date: bool,
186187
local_updated_date: bool,
188+
dates_import: bool,
187189
load_rule_loading: bool,
188190
) -> None:
189191
"""Import rules from json, toml, or yaml files containing Kibana exported rule(s)."""
190192
errors: list[str] = []
191193

194+
if dates_import and (local_creation_date or local_updated_date):
195+
click.echo("Error: --dates-import cannot be used with --local-creation-date or --local-updated-date.")
196+
return
197+
192198
rule_files: list[Path] = []
193199
if directory:
194200
rule_files = list(directory.glob("**/*.*"))
@@ -248,13 +254,14 @@ def import_rules_into_repo( # noqa: PLR0912, PLR0913, PLR0915
248254
contents["author"] = [contents["author"]]
249255

250256
# Parse created_at and updated_at to creation_date and updated_date if they exist in contents
251-
now = datetime.now(UTC).strftime("%Y-%m-%dT%H:%M:%S.%fZ")
252-
contents["creation_date"] = datetime.strptime(
253-
contents.get("created_at", now), "%Y-%m-%dT%H:%M:%S.%fZ"
254-
).strftime("%Y/%m/%d")
255-
contents["updated_date"] = datetime.strptime(contents.get("updated_at", now), "%Y-%m-%dT%H:%M:%S.%fZ").strftime(
256-
"%Y/%m/%d"
257-
)
257+
if dates_import:
258+
now = datetime.now(UTC).strftime("%Y-%m-%dT%H:%M:%S.%fZ")
259+
contents["creation_date"] = datetime.strptime(
260+
contents.get("created_at", now), "%Y-%m-%dT%H:%M:%S.%fZ"
261+
).strftime("%Y/%m/%d")
262+
contents["updated_date"] = datetime.strptime(
263+
contents.get("updated_at", now), "%Y-%m-%dT%H:%M:%S.%fZ"
264+
).strftime("%Y/%m/%d")
258265

259266
contents.update(
260267
update_metadata_from_file(

0 commit comments

Comments
 (0)