Skip to content

Add ruleset and rule triggering logic#156

Merged
okynos merged 16 commits intomainfrom
140-rule-trigger
Apr 30, 2024
Merged

Add ruleset and rule triggering logic#156
okynos merged 16 commits intomainfrom
140-rule-trigger

Conversation

@okynos
Copy link
Member

@okynos okynos commented Apr 29, 2024

Hello!

This PR closes #140 thanks @thisnugroho for the feature request.

We have added a first steps into rule management and generation.
The main features are:

  • Moved config.rs to appconfig.rs This will resolve some naming conflict.
  • Moved init function to init.rs module this will allow to manage initialization in a better way.
  • Added regex crate as a new dependency.
  • Updated OpenSearch index template to reflect rule event attributes.
  • Added rules.yml template, where your rules will be included.
  • Manage rules file as a configuration file in the package management system.
  • Moved TMP_EVENTS static mutable variable to Arc<Mutex> inside appconfig. This will allow to remove unsafe blocks and use a 'singleton' configuration file.
  • Include rule event triggering inside Monitor Event and Audit Event.
  • Added Event generic file where the trait is defined, later coded in each module.
  • Moved Event to MonitorEvent module.
  • Now rotator module contains a configuration instance with all shared variables and previously mentioned mutex.
  • Added ruleevent.rs file that manage Rule Event attributes and processing.
  • Added ruleset.rs file that manage regexes and rule triggering.
  • Fixed Windows service logging error.
  • Improved message logging and reporting.
  • Minor improvements into automatic testing.

@okynos okynos self-assigned this Apr 29, 2024
@okynos okynos merged commit 2b3ea0f into main Apr 30, 2024
@okynos okynos deleted the 140-rule-trigger branch April 30, 2024 05:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Include rules to trigger custom events

1 participant