[FR] Add ES|QL Custom Library for Rule Support #3134
Conversation
|
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
Mikaayenson
requested review from
brokensound77 and
Mikaayenson
as code owners
botelastic
bot
added
Domain: Endpoint
OS: Linux
python
detection_rules/devtools.py
Outdated
| # Define paths | ||
| lexer_file = Path(ESQL_DIR) / 'grammar' / 'EsqlBaseLexer.g4' | ||
| parser_file = Path(ESQL_DIR) / 'grammar' / 'EsqlBaseParser.g4' | ||
| antlr_file = Path(get_path('detection_rules')) / 'etc' / 'antlr-4.13.1-complete.jar' |
There was a problem hiding this comment.
Reminder to myself to delete this and all the checks below.
| @@ -0,0 +1,92 @@ | |||
| [metadata] | |||
There was a problem hiding this comment.
| ('from .ds-logs-endpoint.events.process-default-* | where process.name like "Microsoft*"', | ||
| pytest.raises(ESQLSemanticError), r"ESQL semantic error: Missing metadata for ES|QL query with no stats command"), # noqa: E501 | ||
|
|
||
| # returns 0 because count on non-forwarded field process.parent.name |
There was a problem hiding this comment.
Sample unit tests not yet supported.
Should this PR be put back into draft? |
| print(Trees.toStringTree(ctx, None, parser)) | ||
|
|
||
|
|
||
| # def pretty_print_tree(ctx: EsqlBaseParser.SingleStatementContext, indent: int = 0, is_last: bool = True): |
There was a problem hiding this comment.
Reminder, I think we can remove these commented out function headers and add the type hinting to the active headers?
| # def pretty_print_tree(ctx: EsqlBaseParser.SingleStatementContext, indent: int = 0, is_last: bool = True): |
|
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
|
This has been closed due to inactivity. If you feel this is an error, please re-open and include a justifying comment. |
Issue
Resolves https://github.com/elastic/ia-trade-team/issues/186
Overview
This is a temporary dev branch for ES|QL exploration and custom library implementation. This PR is meant to stay in draft but serve as delta visualization for ES|QL library implementation and dev.
Related: https://github.com/elastic/ia-trade-team/issues/172