Skip to content

Conversation

nick-benoit
Copy link
Contributor

@nick-benoit nick-benoit commented Oct 13, 2025

  • Add support for threat
  • Gracefully support query not being set
  • Add esql specific validations to reject unsupported fields index and filters
  • Add computed to action frequency to handle kibana provided defaults
  • Add anomaly detection validation for required anomaly_threshold
  • Add support for timeline_id and timeline_title fields
  • Mark threat_query as computed to handle api provided default ""

Each change is self contained in a single commit, so it might be easier to review each separately.

Note: In general we want to move away from adding validations in models_* files I added some here due to time constraints. As part of the next milestone I plan to swap these out for validations at the schema level.

@nick-benoit nick-benoit force-pushed the security-detection-rule-updates branch from c7799a4 to 9937ac5 Compare October 13, 2025 18:54
@nick-benoit nick-benoit changed the title Security Detection Rule Updates (WIP) Security Detection Rule Updates Oct 13, 2025
@nick-benoit nick-benoit force-pushed the security-detection-rule-updates branch from be8d600 to d5f8971 Compare October 14, 2025 01:08
@nick-benoit nick-benoit requested a review from tobio October 14, 2025 02:50
@nick-benoit nick-benoit changed the title (WIP) Security Detection Rule Updates Security Detection Rule Updates Oct 14, 2025
@nick-benoit nick-benoit marked this pull request as ready for review October 14, 2025 02:55
Copy link
Member

@tobio tobio left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need a changelog entry as well.

}

// convertThreatToModel converts kbapi.SecurityDetectionsAPIThreatArray to Terraform model
func convertThreatToModel(ctx context.Context, apiThreats *kbapi.SecurityDetectionsAPIThreatArray) (types.List, diag.Diagnostics) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gemini_Generated_Image_v2i0h9v2i0h9v2i0

@nick-benoit
Copy link
Contributor Author

We need a changelog entry as well.

Added changelog: 4e9621a

@nick-benoit nick-benoit merged commit 8b7875c into main Oct 14, 2025
54 checks passed
@nick-benoit nick-benoit deleted the security-detection-rule-updates branch October 14, 2025 12:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants