Hepl me please

[vlados31999]

Hello everyone
I can't set up my custom rules verification. Could you please tell me how to set this up?

[eric-forte-elastic]

👋 Hi @vlados31999 happy to help, have you taken a look at our quick start guide? What seems to be the trouble, is a specific command failing? Thanks!

[vlados31999]

Hi @eric-forte-elastic
thanks for the feedback
i did everything according to the instructions

1. initialized the custom rules directory (python -m detection_rules custom-rules setup-config )
2. moved one toml rule to dac_custom_rules_dir/rules
3. set the environment variable to the doc_custom_rules_dir directory (export CUSTOM_RULES_DIR="<full_path_to_dark_custom_rules_dir>")
   I can't figure out how to make my rules test in dac_custom_rules_dir/rules
   can you help me?

[eric-forte-elastic]

For testing rules, assuming you ran the following

python -m detection_rules custom-rules setup-config dac_custom_rules_dir

Then moved a rule to dac_custom_rules_dir/rules
and then ran export CUSTOM_RULES_DIR=<full_path_to_custom_rules_dir>

You would then be able to test your rules by running:

python -m detection_rules test

[vlados31999]

@eric-forte-elastic
Thanks, it worked.
Can you tell me where I can learn more about existing unit tests?

[eric-forte-elastic]

@eric-forte-elastic Thanks, it worked. Can you tell me where I can learn more about existing unit tests?

Sure! For some general information and goals of the unit tests, take a look at our DaC Reference documentation in the unit tests section. You might also be interested in our custom rules management documentation in the this repo that goes over more information about the configuration files, structure, and some of your testing options.

Also, you might want to check out our DaC Channel in our community slack too if you have not already.