|
37 | 37 | from detection_rules.rule_loader import FILE_PATTERN, RULES_CONFIG |
38 | 38 | from detection_rules.rule_validators import EQLValidator, KQLValidator |
39 | 39 | from detection_rules.schemas import definitions, get_min_supported_stack_version, get_stack_schemas |
40 | | -from detection_rules.utils import INTEGRATION_RULE_DIR, PatchedTemplate, get_path, make_git |
| 40 | +from detection_rules.utils import ETC_DIR, INTEGRATION_RULE_DIR, PatchedTemplate, get_path, make_git |
41 | 41 | from detection_rules.version_lock import loaded_version_lock |
42 | 42 |
|
43 | 43 | from .base import BaseRuleTest |
@@ -1044,22 +1044,21 @@ def test_event_dataset(self): |
1044 | 1044 | def test_min_stack_version_supported(self): |
1045 | 1045 | failures = [] |
1046 | 1046 | # Load supported stack versions from stack-schema-map.yaml |
1047 | | - stack_map_path = Path("detection_rules/etc/stack-schema-map.yaml") |
| 1047 | + stack_map_path = Path(f"{ETC_DIR}/stack-schema-map.yaml") |
1048 | 1048 | with Path.open(stack_map_path) as f: |
1049 | 1049 | stack_map = yaml.safe_load(f) |
1050 | 1050 |
|
1051 | 1051 | # Get the minimum supported stack version (as string) |
1052 | 1052 | supported_versions = [v for v in stack_map if not v.startswith("#") and isinstance(v, str)] |
1053 | | - min_supported = min(supported_versions, key=lambda v: tuple(map(int, v.split(".")))) |
| 1053 | + def version_tuple(v): |
| 1054 | + return tuple(map(int, v.split("."))) |
| 1055 | + min_supported = min(supported_versions, key=version_tuple) |
1054 | 1056 | # Load all production rules |
1055 | 1057 | for rule in self.all_rules: |
1056 | 1058 | min_stack_version = rule.contents.metadata.get("min_stack_version") |
1057 | 1059 | if not min_stack_version: |
1058 | 1060 | continue # skip rules without min_stack_version |
1059 | 1061 | # Compare versions as tuples of ints |
1060 | | - def version_tuple(v): |
1061 | | - return tuple(map(int, v.split("."))) |
1062 | | - |
1063 | 1062 | if version_tuple(min_stack_version) < version_tuple(min_supported): |
1064 | 1063 | failures.append( |
1065 | 1064 | f"{self.rule_str(rule)}" |
|
0 commit comments